diff --git a/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/guidance-for-the-configuration-of-private-registries-for-dependabot.md b/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/guidance-for-the-configuration-of-private-registries-for-dependabot.md
index d77b65a1157d..3d147331f6a9 100644
--- a/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/guidance-for-the-configuration-of-private-registries-for-dependabot.md
+++ b/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/guidance-for-the-configuration-of-private-registries-for-dependabot.md
@@ -41,7 +41,8 @@ You'll find detailed guidance for the setup of the following package managers:
 * [npm](#npm)
 * [NuGet](#nuget)
 * [pub](#pub)
-* [Python](#python)
+* [Python](#python) (includes pip, pip-compile, pipenv, and poetry){% ifversion dependabot-uv-support %}
+* [uv](#uv){% endif %}
 * [Yarn](#yarn)
 
 You'll also find recommendations for the setup of the following registry hosts:
@@ -69,7 +70,7 @@ Bun adheres to the same configuration guidelines as npm. Note that the `.npmrc`
 
 Supported by Artifactory, Artifacts, Cloudsmith, {% data variables.product.prodname_registry %} registry, Nexus, and ProGet.
 
-You can authenticate with either a username and password, or a token. For more information, see `rubygems-server` in [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#rubygems-server).
+You can authenticate with either a username and password, or a token. For more information, see `rubygems-server` in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#rubygems-server).
 
 Snippet of a `dependabot.yml` file using a username and password.
 
@@ -106,7 +107,7 @@ registries:
 
 ### Cargo
 
-Cargo supports username, password and token-based authentication. For more information, see `cargo-registry` in [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#cargo-registry).
+Cargo supports username, password and token-based authentication. For more information, see `cargo-registry` in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#cargo-registry).
 
 The snippet below shows a `dependabot.yml` file configuration that uses a token.
 
@@ -114,7 +115,7 @@ The snippet below shows a `dependabot.yml` file configuration that uses a token.
 
 ### Docker
 
-Docker supports using a username and password for registries. For more information, see `docker-registry` in [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#docker-registry).
+Docker supports using a username and password for registries. For more information, see `docker-registry` in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#docker-registry).
 
 Snippet of `dependabot.yml` file using a username and password.
 
@@ -171,7 +172,7 @@ Docker Compose adheres to the same configuration guidelines as Docker. For more
 
 ### Helm Charts
 
-Helm supports using a username and password for registries. For more information, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#helm-registry).
+Helm supports using a username and password for registries. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#helm-registry).
 
 Snippet of `dependabot.yml` file using a username and password.
 
@@ -209,7 +210,7 @@ When configuring {% data variables.product.prodname_dependabot %} for Helm chart
 
 {% data variables.product.prodname_dependabot %} doesn't run Gradle but supports updates to certain Gradle files. For more information, see "Gradle" in [AUTOTITLE](/code-security/dependabot/ecosystems-supported-by-dependabot/supported-ecosystems-and-repositories#gradle).
 
-Gradle supports the `maven-repository` registry type. For more information, see `maven-repository` in [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#maven-repository).
+Gradle supports the `maven-repository` registry type. For more information, see `maven-repository` in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#maven-repository).
 
 The `maven-repository` type supports username, password and replaces-base. {% data reusables.dependabot.password-definition %}
 
@@ -281,7 +282,7 @@ This feature enables unified dependency management for both public and private G
 
 ### Maven
 
-Maven supports username, password and replaces-base. For more information, see `maven-repository` in [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#maven-repository).
+Maven supports username, password and replaces-base. For more information, see `maven-repository` in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#maven-repository).
 
 {% raw %}
 
@@ -331,7 +332,7 @@ You can define the configuration in the `dependabot.yml` file using the `npm-reg
 
 #### Using the `npm-registry` type in the configuration file
 
-You can define the private registry configuration in a `dependabot.yml` file using the `npm-registry` type. For more information, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#npm-registry).
+You can define the private registry configuration in a `dependabot.yml` file using the `npm-registry` type. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#npm-registry).
 
 The snippet of a `dependabot.yml` file below uses a token. {% data reusables.dependabot.token-is-github-pat %}
 
@@ -412,7 +413,7 @@ If you use a monorepo, the `.npmrc` file should live in the project's root direc
 
 You can configure {% data variables.product.prodname_dependabot %} to send all registry requests through a specified base URL. In order for {% data variables.product.prodname_dependabot %} to access a public dependency, the registry must either have a cloned copy of the dependency with the requested version, or allow traffic to fetch from a public registry if the dependency is not available.
 
-If there is no global registry defined in a `.npmrc` file, you can set `replaces-base` to `true` in the `dependabot.yml` file. For more information, see "`replaces-base`" in [Top-level `registries` key](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#top-level-registries-key).
+If there is no global registry defined in a `.npmrc` file, you can set `replaces-base` to `true` in the `dependabot.yml` file. For more information, see "`replaces-base`" in [Top-level `registries` key](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/dependabot-options-reference#top-level-registries-key).
 
 #### Notes
 
@@ -426,7 +427,7 @@ Registries should be configured using the `https` protocol.
 
 Supported by Artifactory, Artifacts, Cloudsmith, {% data variables.product.prodname_registry %} registry, Nexus, and ProGet.
 
-The `nuget-feed` type supports username and password, or token. For more information, see `nuget-feed` in [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#nuget-feed).
+The `nuget-feed` type supports username and password, or token. For more information, see `nuget-feed` in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#nuget-feed).
 
 {% raw %}
 
@@ -472,7 +473,7 @@ registries:
 
 ### pub
 
-You can define the private registry configuration in a `dependabot.yml` file using the `pub-repository` type. For more information, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#pub-repository).
+You can define the private registry configuration in a `dependabot.yml` file using the `pub-repository` type. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#pub-repository).
 
 {% raw %}
 
@@ -505,7 +506,7 @@ pub supports URL and token authentication. The URL used for the registry should
 
 Supported by Artifactory, Azure Artifacts, Cloudsmith, Nexus, and ProGet. The {% data variables.product.prodname_registry %} registry is not supported.
 
-The `python-index` type supports username and password, or token. For more information, see `python-index` in [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#python-index).
+The `python-index` type supports username and password, or token. For more information, see `python-index` in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#python-index).
 
 {% raw %}
 
@@ -550,9 +551,17 @@ registries:
 
 `url` should contain the URL, organization, and the "feed" or repository.
 
+{% ifversion dependabot-uv-support %}
+
+### uv
+
+The uv registry uses a configuration similar to that of the python index. For more information, see "`python-index`" in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#python-index).
+
+{% endif %}
+
 ### Yarn
 
-The Yarn registry uses a configuration similar to that of the npm registry. For more information, see "`npm-registry`" in [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#npm-registry).
+The Yarn registry uses a configuration similar to that of the npm registry. For more information, see "`npm-registry`" in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#npm-registry).
 
 {% raw %}
 
@@ -576,7 +585,7 @@ You can either specify the private registry configuration in the `dependabot.yml
 
 ##### Defining the private registry configuration in the `dependabot.yml` file
 
-You can define the private registry configuration in your `dependabot.yml` file. For more information, see [Top-level `registries` key](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#top-level-registries-key).
+You can define the private registry configuration in your `dependabot.yml` file. For more information, see [Top-level `registries` key](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/dependabot-options-reference#top-level-registries-key).
 
 To ensure that the private registry is listed as the dependency source in the project's `yarn.lock` file, you need to run `yarn install` on a machine with private registry access. Yarn should update the resolved field to include the private registry URL.
 
@@ -613,7 +622,7 @@ As with Yarn Classic, you can either specify the private registry configuration
 
 ##### Defining the private registry configuration in the `dependabot.yml` file
 
-You can define the private registry configuration in your `dependabot.yml` file. For more information, see [Top-level `registries` key](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#top-level-registries-key).
+You can define the private registry configuration in your `dependabot.yml` file. For more information, see [Top-level `registries` key](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/dependabot-options-reference#top-level-registries-key).
 
 To ensure the private registry is listed as the dependency source in the project's `yarn.lock` file, run `yarn install` on a machine with private registry access. Yarn should update the resolved field to include the private registry URL.
 
diff --git a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md
index fc407ab67954..49d4a24ff91a 100644
--- a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md
+++ b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md
@@ -100,10 +100,10 @@ For most package managers, you should define a value that will match the depende
 | Dependency types | Supported by package managers | Allow updates |
 |------------------|-------------------------------|--------|
 | `direct` | All | All explicitly defined dependencies. |
-| `indirect` | `bundler`, `pip`, `composer`, `cargo`, `gomod` | Dependencies of direct dependencies (also known as sub-dependencies, or transitive dependencies).|
-| `all` | All | All explicitly defined dependencies. For `bundler`, `pip`, `composer`, `cargo`, `gomod`, also the dependencies of direct dependencies.|
-| `production` | `bundler`, `composer`, `mix`, `maven`, `npm`, `pip` (not all managers) | Only to dependencies defined by the package manager as production dependencies. |
-| `development`| `bundler`, `composer`, `mix`, `maven`, `npm`, `pip` (not all managers) | Only to dependencies defined by the package manager as development dependencies. |
+| `indirect` | `bundler`, `pip`, `composer`, `cargo`, `gomod`{% ifversion dependabot-uv-support %}, `uv`{% endif %} | Dependencies of direct dependencies (also known as sub-dependencies, or transitive dependencies).|
+| `all` | All | All explicitly defined dependencies. For `bundler`, `pip`, `composer`, `cargo`, `gomod`{% ifversion dependabot-uv-support %}, `uv`{% endif %}, also the dependencies of direct dependencies.|
+| `production` | `bundler`, `composer`, `mix`, `maven`, `npm`, `pip`{% ifversion dependabot-uv-support %}, `uv`{% endif %} (not all managers) | Only to dependencies defined by the package manager as production dependencies. |
+| `development`| `bundler`, `composer`, `mix`, `maven`, `npm`, `pip`{% ifversion dependabot-uv-support %}, `uv`{% endif %} (not all managers) | Only to dependencies defined by the package manager as development dependencies. |
 
 ## `assignees` {% octicon "versions" aria-label="Version updates" height="24" %} {% octicon "shield-check" aria-label="Security updates" height="24" %}
 
@@ -151,7 +151,11 @@ When `commit-message` is defined:
 
 ### `prefix-development`
 
+{% ifversion dependabot-uv-support %}
+Supported by: `bundler`, `composer`, `mix`, `maven`, `npm`, `pip`, and `uv`.
+{% else %}
 Supported by: `bundler`, `composer`, `mix`, `maven`, `npm`, and `pip`.
+{% endif %}
 
 * Used only for commit messages that update dependencies in the Development dependency group.
 * Otherwise, the parameter behaves exactly as the `prefix` parameter.
@@ -359,7 +363,7 @@ Specify which semantic versions (SemVer) to ignore. SemVer is an accepted standa
 
 Supported by: `bundler`, `mix`, and `pip`.
 
-Allow {% data variables.product.prodname_dependabot %} to execute external code in the manifest during updates. For examples, see [Allowing external code execution](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#allowing-external-code-execution).
+Allow {% data variables.product.prodname_dependabot %} to execute external code in the manifest during updates. For examples, see [Allowing external code execution](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#allowing-external-code-execution).
 
 {% data variables.product.prodname_dependabot %} default behavior:
 
@@ -431,7 +435,7 @@ When `multi-ecosystem-groups` is used:
 Assign individual package ecosystems to a multi-ecosystem group using the `multi-ecosystem-group` parameter in your `updates` configuration.
 
 > [!IMPORTANT]
-> Multi-ecosystem updates require specific configuration patterns and have unique parameter merging behavior. For complete setup instructions, configuration examples, and detailed parameter reference, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-multi-ecosystem-updates).
+> Multi-ecosystem updates require specific configuration patterns and have unique parameter merging behavior. For complete setup instructions, configuration examples, and detailed parameter reference, see [AUTOTITLE](/code-security/tutorials/secure-your-dependencies/configuring-multi-ecosystem-updates).
 
 ```yaml copy
 # Basic `dependabot.yml` file defining a multi-ecosystem-group
@@ -527,7 +531,9 @@ Package manager | YAML value      | Supported versions |
 | {% endif %} |
 | Swift   | `swift`      | v5  |
 | Terraform    | `terraform`      | >= 0.13, <= 1.10.x  |
+| {% ifversion dependabot-uv-support %} |
 | uv           | `uv`             | v0 |
+| {% endif %} |
 | {% ifversion dependabot-vcpkg-support %} |
 | vcpkg       | `vcpkg`          | Not applicable   |
 | {% endif %} |
@@ -568,11 +574,11 @@ When `rebase-strategy` is set to `disabled`, {% data variables.product.prodname_
 
 ## `registries` {% octicon "versions" aria-label="Version updates" height="24" %} {% octicon "shield-check" aria-label="Security updates" height="24" %}
 
-Configure access to private package registries to allow {% data variables.product.prodname_dependabot %} to update a wider range of dependencies, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot) and [AUTOTITLE](/code-security/dependabot/working-with-dependabot/guidance-for-the-configuration-of-private-registries-for-dependabot).
+Configure access to private package registries to allow {% data variables.product.prodname_dependabot %} to update a wider range of dependencies, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot) and [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/guidance-for-the-configuration-of-private-registries-for-dependabot).
 
 There are 2 locations in the `dependabot.yml` file where you can use the `registries` key:
 
-1. At the top level, where you define the private registries you want to use and their access information, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot).
+1. At the top level, where you define the private registries you want to use and their access information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot).
 1. Within the `updates` blocks, where you can specify which private registries each package manager should use.
 
 {% data variables.product.prodname_dependabot %} default behavior is to raise pull requests only to update dependencies stored in publicly accessible registries.
@@ -806,7 +812,11 @@ Supported values: `true` or `false`
 
 ## `versioning-strategy` {% octicon "versions" aria-label="Version updates" height="24" %} {% octicon "shield-check" aria-label="Security updates" height="24" %}
 
-Supported by: `bundler`, `cargo`, `composer`, `mix`, `npm`, `pip`, `pub`
+{% ifversion dependabot-uv-support %}
+Supported by: `bundler`, `cargo`, `composer`, `mix`, `npm`, `pip`, `pub`, and `uv`
+{% else %}
+Supported by: `bundler`, `cargo`, `composer`, `mix`, `npm`, `pip`, and `pub`
+{% endif %}
 
 Define how {% data variables.product.prodname_dependabot %} should edit manifest files. For examples, see [AUTOTITLE](/code-security/dependabot/dependabot-version-updates/controlling-dependencies-updated#defining-a-versioning-strategy).
 
@@ -945,12 +955,12 @@ The parameters used to provide authentication details for access to a private re
 | `rubygems-server` | `username` and `password`<br>or `token`<br>or OIDC with `tenant-id` and `client-id` |
 | `terraform-registry` | `token` |
 
-All sensitive data used for authentication should be stored securely and referenced from that secure location, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot).
+All sensitive data used for authentication should be stored securely and referenced from that secure location, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot).
 
 > [!TIP]
 > {% data reusables.dependabot.password-definition %}
 
-For more information about  OIDC support for {% data variables.product.prodname_dependabot %}, see [AUTOTITLE](/actions/concepts/security/openid-connect#oidc-support-for-dependabot) and [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#using-oidc-for-authentication).
+For more information about  OIDC support for {% data variables.product.prodname_dependabot %}, see [AUTOTITLE](/actions/concepts/security/openid-connect#oidc-support-for-dependabot) and [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-access-to-private-registries-for-dependabot#using-oidc-for-authentication).
 
 ### `url` and `replaces-base`
 
diff --git a/content/copilot/reference/ai-models/model-hosting.md b/content/copilot/reference/ai-models/model-hosting.md
index 104109a9241e..84c40c3c5a73 100644
--- a/content/copilot/reference/ai-models/model-hosting.md
+++ b/content/copilot/reference/ai-models/model-hosting.md
@@ -30,6 +30,7 @@ Used for:
 * {% data variables.copilot.copilot_gpt_51_codex_max %}
 * {% data variables.copilot.copilot_gpt_52 %}
 * {% data variables.copilot.copilot_gpt_52_codex %}
+* {% data variables.copilot.copilot_gpt_53_codex %}
 
 These models are hosted by OpenAI and {% data variables.product.github %}'s Azure infrastructure.
 
diff --git a/data/features/dependabot-uv-security-support.yml b/data/features/dependabot-uv-security-support.yml
new file mode 100644
index 000000000000..c5fef6d8c740
--- /dev/null
+++ b/data/features/dependabot-uv-security-support.yml
@@ -0,0 +1,6 @@
+# Reference: #16918
+# UV security update support for Dependabot
+versions:
+  fpt: '*'
+  ghec: '*'
+  ghes: '> 3.20'
diff --git a/data/features/dependabot-uv-support.yml b/data/features/dependabot-uv-support.yml
new file mode 100644
index 000000000000..d4a02bf1e299
--- /dev/null
+++ b/data/features/dependabot-uv-support.yml
@@ -0,0 +1,6 @@
+# Reference: #16918
+# UV support for Dependabot
+versions:
+  fpt: '*'
+  ghec: '*'
+  ghes: '> 3.16'
diff --git a/data/reusables/dependabot/supported-package-managers.md b/data/reusables/dependabot/supported-package-managers.md
index 928218f94f99..cc77bb32f64d 100644
--- a/data/reusables/dependabot/supported-package-managers.md
+++ b/data/reusables/dependabot/supported-package-managers.md
@@ -49,7 +49,11 @@ poetry         | `pip`            | v1               | {% octicon "check" aria-l
 | {% endif %} |
 [Swift](#swift)      | `swift`      | v5  | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} (git only) | {% octicon "x" aria-label="Not supported" %} |
 [Terraform](#terraform)      | `terraform`      | >= 0.13, <= 1.13.x  | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | Not applicable |
+| {% ifversion dependabot-uv-security-support %} |
 uv        | `uv`            | v0               | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | Not applicable |
+| {% elsif dependabot-uv-support %} |
+uv        | `uv`            | v0               | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | Not applicable |
+| {% endif %} |
 | {% ifversion dependabot-vcpkg-support %} |
 [vcpkg](#vcpkg) | `vcpkg`          | Not applicable   | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | Not applicable |
 | {% endif %} |
diff --git a/data/tables/copilot/model-multipliers.yml b/data/tables/copilot/model-multipliers.yml
index f343ef8832e5..4283c91a8f53 100644
--- a/data/tables/copilot/model-multipliers.yml
+++ b/data/tables/copilot/model-multipliers.yml
@@ -93,6 +93,10 @@
   multiplier_paid: 1.0
   multiplier_free: Not applicable
 
+- name: GPT-5.3-Codex
+  multiplier_paid: 1.0
+  multiplier_free: Not applicable
+
 - name: Grok Code Fast 1
   multiplier_paid: 0.25
   multiplier_free: Not applicable
diff --git a/data/tables/copilot/model-release-status.yml b/data/tables/copilot/model-release-status.yml
index 7abda6063bfe..d80e799a53ee 100644
--- a/data/tables/copilot/model-release-status.yml
+++ b/data/tables/copilot/model-release-status.yml
@@ -88,6 +88,13 @@
   ask_mode: true
   edit_mode: true
 
+- name: 'GPT-5.3-Codex'
+  provider: 'OpenAI'
+  release_status: 'GA'
+  agent_mode: true
+  ask_mode: true
+  edit_mode: true
+
 # Anthropic models
 - name: 'Claude Haiku 4.5'
   provider: 'Anthropic'
diff --git a/data/tables/copilot/model-supported-clients.yml b/data/tables/copilot/model-supported-clients.yml
index cbe3cf27b5d4..39425fc65a6e 100644
--- a/data/tables/copilot/model-supported-clients.yml
+++ b/data/tables/copilot/model-supported-clients.yml
@@ -173,6 +173,14 @@
   xcode: true
   jetbrains: true
 
+- name: GPT-5.3-Codex
+  dotcom: true
+  vscode: true
+  vs: false
+  eclipse: false
+  xcode: false
+  jetbrains: false
+
 - name: Grok Code Fast 1
   dotcom: true
   vscode: true
diff --git a/data/tables/copilot/model-supported-plans.yml b/data/tables/copilot/model-supported-plans.yml
index a46efa756c6e..508b90d14d35 100644
--- a/data/tables/copilot/model-supported-plans.yml
+++ b/data/tables/copilot/model-supported-plans.yml
@@ -152,6 +152,13 @@
   business: true
   enterprise: true
 
+- name: GPT-5.3-Codex
+  free: false
+  pro: true
+  pro_plus: true
+  business: true
+  enterprise: true
+
 - name: Grok Code Fast 1
   free: false
   pro: true
diff --git a/data/variables/copilot.yml b/data/variables/copilot.yml
index 7e788f9ded38..f3b85b721d02 100644
--- a/data/variables/copilot.yml
+++ b/data/variables/copilot.yml
@@ -166,6 +166,7 @@ copilot_gpt_51_codex_mini: 'GPT-5.1-Codex-Mini'
 copilot_gpt_51_codex_max: 'GPT-5.1-Codex-Max'
 copilot_gpt_52: 'GPT-5.2'
 copilot_gpt_52_codex: 'GPT-5.2-Codex'
+copilot_gpt_53_codex: 'GPT-5.3-Codex'
 # OpenAI 'o' series:
 copilot_o3: 'o3'
 copilot_o4_mini: 'o4-mini'
diff --git a/eslint.config.ts b/eslint.config.ts
index 37a3cd88d481..b1e162654557 100644
--- a/eslint.config.ts
+++ b/eslint.config.ts
@@ -99,7 +99,6 @@ export default [
 
       // Disabled rules to review
       'no-console': 'off', // 800+
-      '@typescript-eslint/no-explicit-any': 'off',
 
       // Custom rules (disabled by default for now)
       'custom-rules/use-custom-logger': 'off',
@@ -187,6 +186,200 @@ export default [
     },
   },
 
+  // Legacy files with @typescript-eslint/no-explicit-any violations (see github/docs-engineering#5797)
+  {
+    files: [
+      'src/article-api/liquid-renderers/rest-tags.ts',
+      'src/article-api/scripts/generate-api-docs.ts',
+      'src/article-api/transformers/audit-logs-transformer.ts',
+      'src/article-api/transformers/rest-transformer.ts',
+      'src/assets/scripts/validate-asset-images.ts',
+      'src/automated-pipelines/tests/rendering.ts',
+      'src/codeql-cli/scripts/convert-markdown-for-docs.ts',
+      'src/content-linter/lib/helpers/get-lintable-yml.ts',
+      'src/content-linter/lib/helpers/print-annotations.ts',
+      'src/content-linter/lib/helpers/utils.ts',
+      'src/content-linter/lib/init-test.ts',
+      'src/content-linter/lib/linting-rules/code-annotations.ts',
+      'src/content-linter/lib/linting-rules/index.ts',
+      'src/content-linter/lib/linting-rules/internal-links-no-lang.ts',
+      'src/content-linter/lib/linting-rules/journey-tracks-liquid.ts',
+      'src/content-linter/lib/linting-rules/liquid-ifversion-versions.ts',
+      'src/content-linter/lib/linting-rules/liquid-versioning.ts',
+      'src/content-linter/lib/linting-rules/third-party-action-pinning.ts',
+      'src/content-linter/scripts/lint-content.ts',
+      'src/content-linter/scripts/pretty-print-results.ts',
+      'src/content-linter/style/base.ts',
+      'src/content-linter/tests/integration/lint-cli.ts',
+      'src/content-linter/tests/learning-track-liquid.ts',
+      'src/content-linter/tests/lint-files.ts',
+      'src/content-linter/tests/lint-frontmatter-links.ts',
+      'src/content-linter/tests/unit/table-column-integrity-simple.ts',
+      'src/content-render/liquid/engine.ts',
+      'src/content-render/liquid/ifversion.ts',
+      'src/content-render/liquid/indented-data-reference.ts',
+      'src/content-render/liquid/index.ts',
+      'src/content-render/liquid/octicon.ts',
+      'src/content-render/scripts/add-content-type.ts',
+      'src/content-render/scripts/liquid-tags.ts',
+      'src/content-render/scripts/move-by-content-type.ts',
+      'src/content-render/scripts/move-content.ts',
+      'src/content-render/tests/data.ts',
+      'src/content-render/tests/link-error-line-numbers.ts',
+      'src/content-render/unified/alerts.ts',
+      'src/content-render/unified/annotate.ts',
+      'src/content-render/unified/code-header.ts',
+      'src/content-render/unified/copilot-prompt.ts',
+      'src/content-render/unified/heading-links.ts',
+      'src/content-render/unified/index.ts',
+      'src/content-render/unified/module-types.d.ts',
+      'src/content-render/unified/parse-info-string.ts',
+      'src/content-render/unified/rewrite-empty-table-rows.ts',
+      'src/content-render/unified/rewrite-for-rowheaders.ts',
+      'src/content-render/unified/rewrite-local-links.ts',
+      'src/content-render/unified/rewrite-table-captions.ts',
+      'src/content-render/unified/rewrite-thead-th-scope.ts',
+      'src/data-directory/lib/data-directory.ts',
+      'src/data-directory/lib/data-schemas/features.ts',
+      'src/data-directory/lib/data-schemas/learning-tracks.ts',
+      'src/data-directory/lib/get-data.ts',
+      'src/data-directory/scripts/find-orphaned-features/find.ts',
+      'src/dev-toc/generate.ts',
+      'src/early-access/scripts/migrate-early-access-product.ts',
+      'src/early-access/scripts/what-docs-early-access-branch.ts',
+      'src/events/components/events.ts',
+      'src/events/components/experiments/experiment.ts',
+      'src/events/lib/analyze-comment.ts',
+      'src/events/lib/hydro.ts',
+      'src/events/lib/middleware-errors.ts',
+      'src/events/middleware.ts',
+      'src/fixtures/tests/categories-and-subcategory.ts',
+      'src/fixtures/tests/glossary.ts',
+      'src/fixtures/tests/guides.ts',
+      'src/fixtures/tests/homepage.ts',
+      'src/fixtures/tests/liquid.ts',
+      'src/fixtures/tests/markdown.ts',
+      'src/fixtures/tests/translations.ts',
+      'src/frame/components/context/ArticleContext.tsx',
+      'src/frame/components/context/CategoryLandingContext.tsx',
+      'src/frame/components/context/MainContext.tsx',
+      'src/frame/components/context/TocLandingContext.tsx',
+      'src/frame/components/hooks/useQueryParam.ts',
+      'src/frame/components/ui/BumpLink/BumpLink.tsx',
+      'src/frame/lib/create-tree.ts',
+      'src/frame/lib/frontmatter.ts',
+      'src/frame/lib/get-remote-json.ts',
+      'src/frame/lib/page-data.ts',
+      'src/frame/lib/page.ts',
+      'src/frame/lib/read-file-contents.ts',
+      'src/frame/lib/read-frontmatter.ts',
+      'src/frame/lib/read-json-file.ts',
+      'src/frame/middleware/find-page.ts',
+      'src/frame/middleware/resolve-carousels.ts',
+      'src/frame/middleware/set-fastly-surrogate-key.ts',
+      'src/frame/tests/page.ts',
+      'src/frame/tests/read-frontmatter.ts',
+      'src/frame/tests/server.ts',
+      'src/ghes-releases/scripts/deprecate/update-content.ts',
+      'src/github-apps/lib/index.ts',
+      'src/graphql/lib/index.ts',
+      'src/graphql/pages/breaking-changes.tsx',
+      'src/graphql/pages/changelog.tsx',
+      'src/graphql/pages/reference.tsx',
+      'src/graphql/pages/schema-previews.tsx',
+      'src/graphql/scripts/build-changelog.ts',
+      'src/graphql/scripts/utils/process-previews.ts',
+      'src/graphql/scripts/utils/process-schemas.ts',
+      'src/graphql/scripts/utils/schema-helpers.ts',
+      'src/graphql/tests/validate-schema.ts',
+      'src/journeys/lib/journey-path-resolver.ts',
+      'src/journeys/middleware/journey-track.ts',
+      'src/landings/components/CookBookFilter.tsx',
+      'src/landings/components/ProductGuidesContext.tsx',
+      'src/landings/components/ProductLandingContext.tsx',
+      'src/landings/components/SidebarProduct.tsx',
+      'src/landings/pages/home.tsx',
+      'src/landings/pages/product.tsx',
+      'src/landings/tests/octicons.test.ts',
+      'src/languages/lib/correct-translation-content.ts',
+      'src/languages/lib/get-alert-titles.ts',
+      'src/languages/lib/render-with-fallback.ts',
+      'src/languages/lib/translation-utils.ts',
+      'src/learning-track/lib/process-learning-tracks.ts',
+      'src/links/lib/update-internal-links.ts',
+      'src/links/scripts/check-github-github-links.ts',
+      'src/links/scripts/update-internal-links.ts',
+      'src/links/tests/extract-links.ts',
+      'src/observability/logger/index.ts',
+      'src/observability/logger/lib/logger-context.ts',
+      'src/observability/logger/lib/to-logfmt.ts',
+      'src/observability/middleware/catch-middleware-error.ts',
+      'src/observability/tests/logger.ts',
+      'src/observability/tests/to-logfmt.test.ts',
+      'src/pages/_error.tsx',
+      'src/products/tests/get-product-groups.ts',
+      'src/redirects/middleware/handle-redirects.ts',
+      'src/rest/components/get-rest-code-samples.ts',
+      'src/rest/lib/index.ts',
+      'src/rest/pages/category.tsx',
+      'src/rest/pages/subcategory.tsx',
+      'src/rest/scripts/utils/create-rest-examples.ts',
+      'src/rest/scripts/utils/get-operations.ts',
+      'src/rest/scripts/utils/inject-models-schema.ts',
+      'src/rest/scripts/utils/operation.ts',
+      'src/rest/scripts/utils/sync.ts',
+      'src/rest/scripts/utils/update-markdown.ts',
+      'src/rest/tests/get-rest-code-samples-2.ts',
+      'src/rest/tests/get-rest-code-samples.ts',
+      'src/rest/tests/openapi-schema.ts',
+      'src/rest/tests/rendering.ts',
+      'src/search/components/hooks/useAISearchAutocomplete.ts',
+      'src/search/components/hooks/useAISearchLocalStorageCache.ts',
+      'src/search/components/input/AskAIResults.tsx',
+      'src/search/components/input/SearchOverlay.tsx',
+      'src/search/lib/get-elasticsearch-results/ai-search-autocomplete.ts',
+      'src/search/lib/get-elasticsearch-results/general-search.ts',
+      'src/search/lib/routes/combined-search-route.ts',
+      'src/search/lib/search-request-params/get-search-from-request-params.ts',
+      'src/search/lib/search-request-params/search-params-objects.ts',
+      'src/search/lib/search-request-params/types.ts',
+      'src/search/middleware/search-routes.ts',
+      'src/search/scripts/index/index-cli.ts',
+      'src/search/scripts/index/utils/indexing-elasticsearch-utils.ts',
+      'src/search/scripts/scrape/lib/parse-page-sections-into-records.ts',
+      'src/search/tests/topics.ts',
+      'src/shielding/middleware/handle-invalid-query-string-values.ts',
+      'src/shielding/middleware/handle-invalid-query-strings.ts',
+      'src/tests/helpers/check-url.ts',
+      'src/tests/helpers/e2etest.ts',
+      'src/tests/scripts/copy-fixture-data.ts',
+      'src/tests/vitest.setup.ts',
+      'src/tools/components/Picker.tsx',
+      'src/types/github__markdownlint-github.d.ts',
+      'src/types/markdownlint-lib-rules.d.ts',
+      'src/types/markdownlint-rule-helpers.d.ts',
+      'src/types/markdownlint-rule-search-replace.d.ts',
+      'src/types/primer__octicons.d.ts',
+      'src/versions/scripts/update-versioning-in-files.ts',
+      'src/versions/scripts/use-short-versions.ts',
+      'src/versions/tests/get-applicable-versions.ts',
+      'src/webhooks/lib/index.ts',
+      'src/webhooks/scripts/webhook.ts',
+      'src/workflows/content-changes-table-comment.ts',
+      'src/workflows/enable-automerge.ts',
+      'src/workflows/fr-add-docs-reviewers-requests.ts',
+      'src/workflows/git-utils.ts',
+      'src/workflows/issue-report.ts',
+      'src/workflows/projects.ts',
+      'src/workflows/tests/actions-workflows.ts',
+      'src/workflows/unallowed-contributions.ts',
+      'src/workflows/walk-files.ts',
+    ],
+    rules: {
+      '@typescript-eslint/no-explicit-any': 'off',
+    },
+  },
+
   // Ignored patterns
   // CodeQL scripts included because cocofix is install manually by the workflow
   {
diff --git a/src/audit-logs/data/fpt/organization.json b/src/audit-logs/data/fpt/organization.json
index 87b056266bce..f08e99a42520 100644
--- a/src/audit-logs/data/fpt/organization.json
+++ b/src/audit-logs/data/fpt/organization.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,29 +67,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -72,21 +103,32 @@
     "description": "Credit was accepted for a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Editing a repository security advisory"
   },
@@ -95,21 +137,32 @@
     "description": "Someone was added to the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -117,21 +170,32 @@
     "description": "Credit was declined for a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -140,21 +204,32 @@
     "description": "Someone was removed from the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -163,18 +238,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -182,17 +269,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -203,43 +301,66 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
+  },
   {
     "action": "billing.budget_create",
     "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -255,22 +376,34 @@
     "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "uuid",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -278,25 +411,37 @@
     "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
-      "request_access_security_header",
       "old_target_amount",
       "old_budget_limit_type",
       "old_alert_enabled",
@@ -310,17 +455,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -329,19 +487,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -350,15 +520,28 @@
     "description": "Azure subscription has been linked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -368,15 +551,28 @@
     "description": "Azure subscription has been unlinked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -386,18 +582,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -405,16 +614,28 @@
     "description": "The premium request paid usage policy for your GitHub account was changed.",
     "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -426,39 +647,62 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "user_id",
-      "request_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "checks.auto_trigger_disabled",
-    "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
-    "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
-    "fields": [
-      "visibility",
-      "user_agent",
-      "user",
-      "@timestamp",
-      "repo",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "checks.auto_trigger_disabled",
+    "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
+    "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -467,20 +711,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -491,17 +746,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -509,15 +776,31 @@
     "description": "Existing code scanning alerts appeared in a branch.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -527,15 +810,31 @@
     "description": "Code scanning alerts were fixed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -545,15 +844,31 @@
     "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_numbers",
       "commit_oid",
-      "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business"
+      "ref"
     ],
     "docs_reference_titles": "About code scanning"
   },
@@ -562,15 +877,29 @@
     "description": "Code scanning alerts were manually dismissed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers",
       "dismissal_approver_id"
     ],
@@ -581,19 +910,31 @@
     "description": "Dismissal of code scanning alerts was approved.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -604,19 +945,31 @@
     "description": "Dismissal of code scanning alerts was denied.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "dismissal_request_id",
-      "alert_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismissal_request_id",
+      "alert_number",
+      "public_repo",
       "created_at",
       "operation_type"
     ],
@@ -627,19 +980,31 @@
     "description": "Dismissal of code scanning alerts was requested.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -650,13 +1015,31 @@
     "description": "Code scanning alerts were seen for the first time.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -666,15 +1049,31 @@
     "description": "Code scanning alerts that were previously fixed reappeared.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -684,15 +1083,29 @@
     "description": "Code scanning alerts that were previously dismissed were reopened.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -702,14 +1115,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -719,28 +1147,34 @@
     "description": "An attempt to create a codespace from a prebuild was made.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "owner",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "user_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
       "created_at",
       "operation_type",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -748,17 +1182,30 @@
     "description": "Enterprise setting for Codespaces ownership was updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enablement",
       "organization_names",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -769,25 +1216,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -798,22 +1254,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -825,22 +1292,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -849,15 +1327,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -868,15 +1361,28 @@
     "description": "Policies were applied to codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -886,20 +1392,30 @@
     "description": "Policies were removed from codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -907,19 +1423,30 @@
     "description": "Policies were updated for codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -927,17 +1454,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -947,27 +1487,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "org",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -975,19 +1524,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -995,18 +1557,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -1015,20 +1589,30 @@
     "description": "A commit comment was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "created_at",
-      "@timestamp",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
-      "user_agent",
-      "action",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1036,21 +1620,30 @@
     "description": "A commit comment was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_id",
-      "action",
-      "@timestamp",
-      "repo",
       "org_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1058,21 +1651,33 @@
     "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "reason",
       "plan",
-      "org_id",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1080,13 +1685,28 @@
     "description": "Copilot feature settings were changed at the organization level.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1096,23 +1716,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1120,16 +1747,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -1138,24 +1779,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1163,15 +1810,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1181,20 +1841,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1202,19 +1872,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -1222,21 +1904,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1244,21 +1935,33 @@
     "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_value",
       "new_value",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1266,21 +1969,32 @@
     "description": "The excluded paths for GitHub Copilot were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "excluded_paths",
       "owner_type",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1288,14 +2002,28 @@
     "description": "Copilot custom instructions were created for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "custom_instructions"
@@ -1306,14 +2034,28 @@
     "description": "Copilot custom instructions were updated for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "custom_instructions"
@@ -1324,17 +2066,30 @@
     "description": "The plan for GitHub Copilot was updated.",
     "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_plan",
       "plan",
-      "business_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1346,20 +2101,31 @@
     "description": "The plan for GitHub Copilot was scheduled to be downgraded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "current_plan",
       "scheduled_plan"
@@ -1370,18 +2136,30 @@
     "description": "MCP Configuration for Copilot coding agent was updated for a specific repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "new_config",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_config",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1391,22 +2169,33 @@
     "description": "Specific repositories were disabled from using Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "owner_type",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1414,21 +2203,31 @@
     "description": "Specific repositories were enabled to use Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "owner_type",
-      "owner",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1438,20 +2237,32 @@
     "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_access",
       "old_access",
-      "org_id",
       "owner_type",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1461,21 +2272,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1485,19 +2305,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1507,21 +2336,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1531,18 +2369,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1555,18 +2406,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1580,14 +2444,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -1600,8 +2479,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1610,27 +2488,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1639,19 +2525,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1660,16 +2558,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repository",
-      "repository_id",
-      "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
       "operation_type",
       "definition_id"
@@ -1681,19 +2592,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1702,19 +2624,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1723,19 +2656,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1744,19 +2688,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1765,25 +2720,33 @@
     "description": "Dismissal of Dependabot alerts was approved.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -1793,25 +2756,33 @@
     "description": "Dismissal request for Dependabot alerts was canceled.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -1821,25 +2792,33 @@
     "description": "Dismissal of Dependabot alerts was requested.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -1849,25 +2828,33 @@
     "description": "Dismissal of Dependabot alerts was denied.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -1877,21 +2864,31 @@
     "description": "The default repository access for Dependabot was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "access_level",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "access_level",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -1900,17 +2897,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1918,19 +2928,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1939,19 +2960,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1959,19 +2991,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1980,19 +3023,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2000,19 +3054,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -2021,19 +3086,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2041,19 +3117,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -2062,42 +3149,61 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "discussion_comment.destroy",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "repo",
-      "org",
-      "repo_id",
-      "request_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "discussion_comment.destroy",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2105,20 +3211,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "request_id",
-      "org",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2126,22 +3242,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "actor_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "title",
-      "_document_id",
-      "created_at",
-      "repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2149,17 +3274,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2170,16 +3309,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2190,18 +3343,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
       "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2212,17 +3379,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was created.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "org_id",
       "action",
-      "request_id",
-      "org",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -2231,17 +3411,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "actor_id",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -2250,46 +3443,65 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "Managing environments for deployment"
-  },
-  {
-    "action": "environment.create",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Managing environments for deployment"
+  },
+  {
+    "action": "environment.create",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2297,28 +3509,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2327,27 +3545,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2356,25 +3582,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2383,26 +3617,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2411,21 +3652,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2434,22 +3687,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2458,25 +3721,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "public_repo",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "visibility",
+      "operation_type",
+      "created_at",
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2485,22 +3757,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2509,21 +3793,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -2534,19 +3828,30 @@
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2555,20 +3860,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2577,19 +3892,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2598,23 +3924,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2622,18 +3957,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2644,20 +3989,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2667,25 +4022,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -2693,25 +4058,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -2719,26 +4093,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -2747,25 +4130,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -2773,26 +4165,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -2800,21 +4201,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -2823,19 +4235,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -2843,21 +4268,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -2866,19 +4302,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -2889,47 +4339,70 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
-      "actor",
-      "created_at",
       "_document_id",
-      "repository_selection",
-      "integration",
-      "user_id",
-      "user",
       "action",
-      "operation_type",
-      "name",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "application_client_id"
-    ],
-    "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "repository_selection",
+      "integration",
+      "operation_type",
+      "name",
+      "application_client_id"
+    ],
+    "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
   {
     "action": "integration_installation.repositories_added",
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2940,23 +4413,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2967,21 +4452,33 @@
     "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
       "operation_type",
-      "@timestamp",
       "integration",
-      "action",
-      "user_agent",
       "reason",
-      "_document_id",
-      "org",
-      "org_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -2992,20 +4489,32 @@
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
       "@timestamp",
-      "actor_id",
-      "org",
       "_document_id",
-      "requester",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "requester",
       "created_at",
       "url",
-      "org_id",
-      "request_id",
       "operation_type",
-      "actor",
       "integration",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -3015,20 +4524,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -3038,19 +4560,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -3059,20 +4595,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -3082,20 +4631,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -3104,20 +4666,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -3126,20 +4701,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -3147,19 +4734,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -3168,19 +4768,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -3189,17 +4802,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -3212,21 +4838,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -3240,17 +4879,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -3262,19 +4914,30 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "user"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3282,19 +4945,30 @@
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3302,20 +4976,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "business",
-      "user_id",
-      "request_id",
-      "actor",
-      "user",
-      "business_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ]
   },
@@ -3324,19 +5007,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3344,24 +5038,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3369,24 +5071,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "ip_allow_list_entry",
-      "org",
-      "operation_type",
-      "created_at",
-      "active",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at",
+      "active"
     ]
   },
   {
@@ -3394,19 +5104,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "actor_id",
       "ip_allow_list_entry",
-      "active",
-      "org_id",
-      "@timestamp"
+      "active"
     ]
   },
   {
@@ -3414,22 +5137,31 @@
     "description": "A comment on an issue was deleted from the repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "org",
-      "repo",
-      "actor_id",
       "@timestamp",
-      "created_at",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "oauth_application_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -3437,24 +5169,30 @@
     "description": "A comment on an issue was pinned to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3465,19 +5203,29 @@
     "description": "A comment on an issue was unpinned from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3488,22 +5236,31 @@
     "description": "A comment on an issue (other than the initial one) changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "action",
-      "repo_id",
-      "org_id",
-      "created_at",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "request_id",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
-      "oauth_application_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -3511,20 +5268,30 @@
     "description": "An issue was marked as blocked by another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
+      "public_repo",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3535,19 +5302,30 @@
     "description": "The blocked by relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3557,20 +5335,30 @@
     "description": "An issue was marked as blocking another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3581,20 +5369,30 @@
     "description": "The blocking relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3605,21 +5403,31 @@
     "description": "An issue was deleted from the repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue",
     "fields": [
-      "user",
-      "actor_id",
-      "created_at",
-      "title",
       "@timestamp",
       "_document_id",
-      "request_id",
-      "actor",
-      "user_id",
       "action",
-      "operation_type",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type"
     ],
     "docs_reference_titles": "Deleting an issue"
   },
@@ -3628,23 +5436,33 @@
     "description": "An issue was pinned to a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
       "action",
       "actor",
-      "operation_type",
-      "owner_type",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "number",
-      "repo",
-      "event",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "owner_type",
+      "number",
+      "event"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3653,22 +5471,32 @@
     "description": "An issue was transferred to another repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "owner_type",
-      "actor_id",
       "number",
-      "repo",
       "operation_type",
-      "_document_id",
-      "repo_id",
-      "action",
-      "request_id",
-      "created_at",
-      "actor",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Transferring an issue to another repository"
   },
@@ -3677,20 +5505,32 @@
     "description": "An issue type was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issue_type_name",
       "description",
       "color",
       "enabled",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3701,20 +5541,32 @@
     "description": "An issue type was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issue_type_name",
       "description",
       "color",
       "enabled",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3725,12 +5577,29 @@
     "description": "An issue type was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "issue_type_name",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "issue_type_name",
       "description",
       "color",
       "enabled",
@@ -3738,11 +5607,6 @@
       "old_description",
       "old_color",
       "old_enabled",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3753,24 +5617,33 @@
     "description": "An issue was unpinned from a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
-      "event",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
-      "action",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "operation_type",
-      "_document_id",
-      "number",
-      "owner_type",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "token_scopes",
-      "request_access_security_header"
+      "user_agent",
+      "event",
+      "created_at",
+      "operation_type",
+      "number",
+      "owner_type"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3779,19 +5652,30 @@
     "description": "The ability for enterprise members to delete issues was disabled  Members cannot delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
-      "operation_type",
-      "request_id",
-      "actor_id",
-      "user_id",
-      "created_at",
       "_document_id",
+      "action",
       "actor",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "org_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3800,18 +5684,29 @@
     "description": "The ability for enterprise members to delete issues was enabled  Members can delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -3821,19 +5716,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user",
-      "request_id",
-      "actor",
-      "business_id",
-      "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3842,18 +5748,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3861,21 +5779,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -3883,21 +5814,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3905,22 +5849,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -3928,19 +5885,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "secondary_category",
-      "operation_type",
-      "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "secondary_category",
+      "operation_type",
+      "marketplace_listing",
       "primary_category",
       "integration"
     ]
@@ -3950,22 +5920,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -3973,22 +5956,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3996,20 +5992,30 @@
     "description": "The ability for members to publish GitHub Pages sites was disabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4018,20 +6024,30 @@
     "description": "The ability for members to publish GitHub Pages sites was enabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4040,21 +6056,30 @@
     "description": "The ability for members to publish private GitHub Pages was disabled  Members cannot publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4063,22 +6088,30 @@
     "description": "The ability for members to publish private GitHub Pages was enabled  Members can publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4087,21 +6120,30 @@
     "description": "The ability for members to publish public GitHub Pages was disabled  Members cannot publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4110,22 +6152,30 @@
     "description": "The ability for members to publish public GitHub Pages was enabled  Members can publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4134,39 +6184,61 @@
     "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "user",
-      "user_id",
-      "business",
-      "operation_type",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
+      "business",
       "business_id",
-      "@timestamp",
-      "created_at",
-      "action"
-    ],
-    "docs_reference_titles": "Enforcing repository management policies in your enterprise"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
   {
     "action": "members_can_delete_repos.disable",
     "description": "The ability for enterprise members to delete repositories was disabled  Members cannot delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "request_id",
-      "org",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "actor",
       "operation_type",
-      "org_id",
-      "action",
-      "@timestamp",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -4176,21 +6248,30 @@
     "description": "The ability for enterprise members to delete repositories was enabled  Members can delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "action",
-      "org_id",
-      "user_id",
-      "business",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
-      "org",
-      "operation_type",
-      "user_agent"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -4201,16 +6282,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -4219,21 +6311,30 @@
     "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "created_at",
-      "user_id",
       "business_id",
-      "user",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "org_id",
-      "@timestamp"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4242,19 +6343,30 @@
     "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "user_id",
-      "business",
-      "business_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "actor_id"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4263,19 +6375,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4283,21 +6407,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4307,16 +6440,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4326,18 +6472,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4347,14 +6506,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -4362,19 +6537,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -4382,18 +6568,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4401,23 +6599,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -4425,16 +6631,30 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "org_id",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4442,24 +6662,32 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
-      "repo_id",
       "operation_type",
-      "@timestamp",
-      "user_agent",
       "created_at",
-      "org",
-      "action",
-      "_document_id",
-      "repo",
-      "actor",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4467,15 +6695,28 @@
     "description": "A network configuration for a hosted compute service was created.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4493,15 +6734,28 @@
     "description": "A network configuration for a hosted compute service was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4514,15 +6768,28 @@
     "description": "A network configuration for a hosted compute service was updated.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4539,20 +6806,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4561,20 +6840,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4583,20 +6874,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4605,20 +6908,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4627,19 +6942,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4648,20 +6976,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4670,20 +7010,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4692,19 +7044,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4713,17 +7078,28 @@
     "description": "An invitation sent to an organization to join an enterprise was accepted.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4734,41 +7110,61 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
-  },
-  {
-    "action": "org.add_disallowed_two_factor_method",
-    "description": "An organization prevented access to resources by users with the given two-factor method.",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
+  },
+  {
+    "action": "org.add_disallowed_two_factor_method",
+    "description": "An organization prevented access to resources by users with the given two-factor method.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "two_factor_method",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "two_factor_method",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4779,21 +7175,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -4802,24 +7208,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4827,21 +7243,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -4849,20 +7275,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4870,22 +7306,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4893,20 +7337,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4914,22 +7368,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4937,43 +7399,64 @@
     "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "new_policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "actor_is_bot"
-    ],
-    "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
-  },
-  {
-    "action": "org.advanced_security_policy_selected_member_disabled",
-    "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
-    "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_policy",
+      "created_at",
       "operation_type",
+      "actor_is_bot"
+    ],
+    "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
+  },
+  {
+    "action": "org.advanced_security_policy_selected_member_disabled",
+    "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
+    "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
+    "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "business_id"
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4982,19 +7465,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -5004,15 +7498,28 @@
     "description": "Third-party application access for outside collaborators was disabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5023,15 +7530,28 @@
     "description": "Third-party application access for outside collaborators was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5042,15 +7562,28 @@
     "description": "The organization was archived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5060,17 +7593,30 @@
     "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
   },
@@ -5079,21 +7625,32 @@
     "description": "An export of the organization's Git events was created.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "start",
       "end",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization"
   },
@@ -5102,16 +7659,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -5120,18 +7690,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
-      "actor",
-      "user_agent",
-      "org_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "blocked_user",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -5140,19 +7723,30 @@
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -5162,22 +7756,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "email",
-      "@timestamp",
-      "actor",
-      "action",
       "operation_type",
-      "user_agent",
-      "org",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -5185,19 +7790,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -5205,16 +7821,28 @@
     "description": "Cleared two-factor authentication restrictions for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5225,23 +7853,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5249,21 +7885,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5271,23 +7917,31 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5295,23 +7949,31 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5319,10 +7981,28 @@
     "description": "Enablement for Code Security features on new repositories has been locked for this organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "action",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5332,10 +8012,28 @@
     "description": "Enablement for Code Security features on new repositories has been unlocked for this organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "action",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5345,21 +8043,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -5368,21 +8075,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -5391,20 +8107,31 @@
     "description": "Access to use Codespaces on internal and private repositories was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "enablement",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "enablement",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization"
   },
@@ -5413,21 +8140,31 @@
     "description": "Ownership and payment for codespaces was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "owner_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
   },
@@ -5436,16 +8173,29 @@
     "description": "A team has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5455,16 +8205,29 @@
     "description": "A team has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5474,19 +8237,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -5495,17 +8269,30 @@
     "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -5514,21 +8301,30 @@
     "description": "A user has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5536,21 +8332,30 @@
     "description": "A user has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5558,16 +8363,29 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
@@ -5577,17 +8395,30 @@
     "description": "The interaction limit for prior contributors only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5596,17 +8427,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5616,16 +8460,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5634,17 +8491,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5653,17 +8523,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5672,22 +8555,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -5696,17 +8587,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5717,15 +8619,28 @@
     "description": "Server statistics were exported for the organization.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5736,18 +8651,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
-      "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -5756,20 +8683,31 @@
     "description": "A GitHub Actions secret was created for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5778,20 +8716,32 @@
     "description": "A GitHub Actions variable was created for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5800,21 +8750,33 @@
     "description": "A Codespaces or Dependabot secret was created for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5822,21 +8784,30 @@
     "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "org_id",
-      "business",
-      "action",
       "@timestamp",
-      "org",
       "_document_id",
-      "business_id",
+      "action",
       "actor",
-      "token_scopes",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "actor_is_bot",
       "oauth_credential_type",
       "managed_oauth_access_id",
@@ -5852,24 +8823,32 @@
     "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
-      "created_at",
-      "org_id",
-      "business_id",
-      "operation_type",
-      "request_id",
       "_document_id",
       "action",
+      "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "token_scopes",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot",
       "oauth_credential_type",
-      "request_access_security_header",
       "managed_oauth_access_id",
       "managed_token_id",
       "managed_oauth_scopes",
@@ -5883,21 +8862,32 @@
     "description": "An owner revoked authorized credentials.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "oauth_application_id",
-      "org_id",
       "operation_type",
-      "action",
-      "business",
-      "request_id",
       "created_at",
-      "business_id",
-      "actor_id",
-      "_document_id",
-      "user_agent",
       "oauth_credential_type",
       "managed_oauth_access_id",
       "managed_token_id",
@@ -5912,18 +8902,30 @@
     "description": "An organization was deleted by a user or staff.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "org_id",
-      "org",
       "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5931,20 +8933,30 @@
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -5953,16 +8965,29 @@
     "description": "Third-party application access restrictions for an organization were disabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization"
@@ -5972,19 +8997,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -5993,14 +9029,31 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sso_url",
       "issuer",
-      "action",
-      "@timestamp",
-      "_document_id",
       "created_at",
-      "org",
       "operation_type"
     ]
   },
@@ -6009,21 +9062,30 @@
     "description": "Display of IP addresses within audit log events for the organization was disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -6032,17 +9094,30 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6050,19 +9125,30 @@
     "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6070,19 +9156,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
-      "action",
-      "actor_id",
-      "org_id"
+      "created_at"
     ]
   },
   {
@@ -6090,19 +9187,30 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -6111,17 +9219,30 @@
     "description": "Third-party application access restrictions for an organization were enabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "operation_type",
-      "org",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization"
   },
@@ -6130,19 +9251,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -6151,19 +9283,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "sso_url",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "issuer",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "sso_url",
+      "created_at",
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -6172,21 +9317,30 @@
     "description": "Display of IP addresses within audit log events for the organization was enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -6195,17 +9349,30 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
   },
@@ -6214,17 +9381,30 @@
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -6233,18 +9413,31 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
-      "org",
-      "user_agent",
-      "request_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "manager",
       "operation_type",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6252,23 +9445,32 @@
     "description": "A new user was invited to join an organization.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
     "fields": [
-      "org",
-      "user_id",
-      "invitation_id",
-      "org_id",
-      "user",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -6277,17 +9479,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6297,19 +9510,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6317,19 +9541,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6337,19 +9572,31 @@
     "description": "Access to an organization was granted for an OAuth App.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "operation_type",
-      "org_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization"
@@ -6359,20 +9606,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -6381,18 +9639,31 @@
     "description": "Access was disabled for an OAuth App that was previously approved.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization",
     "fields": [
-      "request_id",
-      "url",
-      "created_at",
-      "org_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
@@ -6402,19 +9673,31 @@
     "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "url",
-      "org_id",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "url",
       "oauth_application_name"
     ]
   },
@@ -6423,20 +9706,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -6446,16 +9740,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6463,20 +9770,31 @@
     "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "reason",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "reason",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -6485,20 +9803,30 @@
     "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -6507,19 +9835,30 @@
     "description": "An organization owner downloaded the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6528,19 +9867,30 @@
     "description": "An organization owner generated the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6549,19 +9899,30 @@
     "description": "An organization owner printed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6570,19 +9931,30 @@
     "description": "An organization owner viewed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6591,19 +9963,31 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -6612,20 +9996,31 @@
     "description": "A GitHub Actions secret was removed from an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -6634,21 +10029,31 @@
     "description": "A GitHub Actions variable was removed from an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -6657,18 +10062,29 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
@@ -6678,19 +10094,29 @@
     "description": "Removed a two-factor authentication method restriction for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "two_factor_method",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "two_factor_method",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -6701,22 +10127,32 @@
     "description": "A Codespaces or Dependabot secret was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6724,21 +10160,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6746,21 +10191,30 @@
     "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user",
-      "org_id",
-      "created_at",
-      "request_id",
       "@timestamp",
-      "action",
-      "operation_type",
-      "user_agent",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6768,40 +10222,62 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
-      "org",
-      "team",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "org.remove_self_hosted_runner",
-    "description": "A self-hosted runner was removed.",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "org.remove_self_hosted_runner",
+    "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -6810,19 +10286,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
-      "old_login",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_login",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6830,14 +10318,28 @@
     "description": "Triggered when a required workflow is created.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6848,14 +10350,28 @@
     "description": "Triggered when a required workflow is deleted.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6866,14 +10382,28 @@
     "description": "Triggered when a required workflow is updated.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6884,20 +10414,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -6906,18 +10446,29 @@
     "description": "A member's linked identity was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
       "user_id",
-      "@timestamp",
-      "action",
-      "actor_id",
       "user_agent",
-      "_document_id",
-      "request_id",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
@@ -6927,19 +10478,30 @@
     "description": "A member's SAML session was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
-      "actor_id",
-      "created_at",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
   },
@@ -6948,21 +10510,33 @@
     "description": "A self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -6972,21 +10546,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "business",
       "business_id",
-      "programmatic_access_type"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6995,20 +10579,31 @@
     "description": "A self-hosted runner group was renamed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7017,23 +10612,33 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -7042,23 +10647,31 @@
     "description": "A self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7067,19 +10680,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -7088,25 +10714,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7115,21 +10752,32 @@
     "description": "The visibility of a self-hosted runner group was updated via the REST API.",
     "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
   },
@@ -7138,10 +10786,28 @@
     "description": "Enablement for Secret Protection features on new repositories has been locked for this organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "action",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7151,10 +10817,28 @@
     "description": "Enablement for Secret Protection features on new repositories has been unlocked for this organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "action",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7164,21 +10848,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7188,21 +10881,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7212,20 +10914,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7234,22 +10946,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7258,21 +10978,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7281,21 +11010,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7304,22 +11042,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7328,21 +11074,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7351,22 +11106,30 @@
     "description": "Generic secrets have been disabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7374,22 +11137,30 @@
     "description": "Generic secrets have been enabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7397,21 +11168,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7421,21 +11201,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7445,19 +11234,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7467,21 +11267,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7491,21 +11300,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7515,19 +11333,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7537,22 +11366,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7561,22 +11398,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7585,22 +11430,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7609,21 +11462,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7632,21 +11494,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7655,22 +11526,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7679,22 +11558,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7703,12 +11590,28 @@
     "description": "The push protection setting was updated for a secret type for your organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "push_protection_setting",
       "secret_type",
       "secret_type_display_name",
@@ -7721,12 +11624,28 @@
     "description": "The push protection pattern configuration was updated for your organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at"
     ],
     "docs_reference_titles": "About push protection"
@@ -7736,26 +11655,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -7764,26 +11692,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7791,28 +11727,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7820,26 +11764,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7847,32 +11799,66 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
-      "org",
-      "runner_id",
-      "runner_name",
-      "action",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "@timestamp"
-    ],
-    "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
-  },
-  {
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_id",
+      "runner_name",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
+  },
+  {
     "action": "org.self_hosted_runner_online",
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7881,7 +11867,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -7896,18 +11903,28 @@
     "description": "The cache retention policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -7919,18 +11936,28 @@
     "description": "The cache storage policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -7942,20 +11969,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -7964,16 +12002,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -7984,18 +12035,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -8004,17 +12068,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8022,18 +12099,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -8042,18 +12131,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -8062,18 +12164,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -8082,22 +12196,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issuer",
-      "business",
       "operation_type",
       "created_at",
-      "request_id",
-      "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8105,21 +12229,32 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
   },
@@ -8128,19 +12263,30 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8151,15 +12297,28 @@
     "description": "The organization was unarchived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8169,19 +12328,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
-      "oauth_application_id",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "blocked_user",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -8190,20 +12362,32 @@
     "description": "A GitHub Actions secret was updated for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "created_at",
       "key",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -8212,23 +12396,34 @@
     "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -8237,20 +12432,32 @@
     "description": "A GitHub Actions variable was updated for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -8259,20 +12466,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -8280,18 +12499,30 @@
     "description": "The settings policy for immutable releases was updated for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_policy",
       "new_policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8302,22 +12533,33 @@
     "description": "A Codespaces or Dependabot secret was updated for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8326,20 +12568,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -8347,17 +12600,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -8367,20 +12633,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -8389,17 +12666,30 @@
     "description": "The name of the default branch was changed for new repositories in the organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
   },
@@ -8408,17 +12698,30 @@
     "description": "The repository self-hosted runners policy was updated",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_repo_runners_policy",
       "new_repo_runners_policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8429,19 +12732,32 @@
     "description": "An organization's SAML provider settings were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "issuer",
-      "org",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -8449,18 +12765,30 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
-      "actor",
-      "actor_id",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "org",
       "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
@@ -8469,21 +12797,31 @@
     "description": "An organization's custom property value was manually set for the first time.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8495,21 +12833,31 @@
     "description": "An organization's custom property value was deleted.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8521,18 +12869,30 @@
     "description": "A default label was created for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
-      "_document_id",
-      "action",
-      "created_at",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label"
   },
@@ -8541,17 +12901,30 @@
     "description": "A default label was deleted for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label"
   },
@@ -8560,17 +12933,30 @@
     "description": "A default label was edited for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label",
     "fields": [
-      "org",
-      "created_at",
       "@timestamp",
-      "actor",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label"
   },
@@ -8579,20 +12965,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "org_id",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -8601,16 +13000,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8619,14 +13033,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -8637,34 +13066,62 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "operation_type",
-      "domain_name",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
       "_document_id",
-      "actor_id"
-    ],
-    "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
-  },
-  {
-    "action": "organization_moderators.add_team",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "domain_name",
+      "created_at"
+    ],
+    "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
+  },
+  {
+    "action": "organization_moderators.add_team",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -8674,17 +13131,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8694,16 +13162,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -8713,20 +13194,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -8734,19 +13225,30 @@
     "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor",
-      "business_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
       "user_agent",
-      "_document_id",
       "created_at",
-      "operation_type",
-      "request_id",
-      "business"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -8755,19 +13257,30 @@
     "description": "Organization projects were disabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -8776,18 +13289,29 @@
     "description": "Organization projects were enabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor_id",
-      "org_id",
-      "created_at",
-      "user_id",
-      "org",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
@@ -8797,23 +13321,33 @@
     "description": "An organization role was assigned to a user or team.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About custom organization roles"
   },
@@ -8822,25 +13356,32 @@
     "description": "A custom organization role was created in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8852,25 +13393,32 @@
     "description": "A custom organization role was deleted in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8881,19 +13429,30 @@
     "description": "A user or team was unassigned an organization role.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type"
     ],
@@ -8904,26 +13463,33 @@
     "description": "A custom organization role was edited in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
       "old_role_permissions",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -8936,22 +13502,33 @@
     "description": "An organization's default project base role was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_project_base_role",
-      "new_project_base_role",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_project_base_role",
+      "new_project_base_role",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8959,20 +13536,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -8982,23 +13570,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -9007,21 +13606,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -9032,21 +13642,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -9055,20 +13678,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -9077,41 +13714,70 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
-      "owner_type",
-      "domain",
-      "state",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type"
-    ],
-    "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
-  },
-  {
-    "action": "pages_protected_domain.verify",
-    "description": "A GitHub Pages domain was verified for an organization or enterprise.",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
+      "owner_type",
+      "domain",
+      "state",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
+  },
+  {
+    "action": "pages_protected_domain.verify",
+    "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -9120,18 +13786,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9139,16 +13817,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9156,18 +13848,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9175,18 +13879,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9197,22 +13914,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9220,22 +13946,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9243,18 +13978,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9265,19 +14013,29 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
       "actor_is_bot"
     ]
@@ -9287,18 +14045,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9309,23 +14077,34 @@
     "description": "A personal access token expiration limit was set.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "token_expiration",
       "old_token_expiration",
       "exempt_administrators",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9333,21 +14112,32 @@
     "description": "A personal access token expiration limit was unset.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "programmatic_access_type",
-      "old_token_expiration",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_token_expiration",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9355,17 +14145,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9376,18 +14179,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9399,17 +14215,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9421,20 +14250,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9446,20 +14284,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9471,20 +14318,29 @@
     "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9496,20 +14352,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9521,15 +14386,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9539,17 +14419,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9559,15 +14450,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9577,19 +14483,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "business_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9597,23 +14514,30 @@
     "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "created_at",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
-      "repo",
       "action",
-      "user_agent",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "request_id",
-      "user_id",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9621,23 +14545,30 @@
     "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "repo",
-      "org",
-      "business",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org_id",
-      "created_at",
-      "business_id"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9645,17 +14576,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9665,17 +14607,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9685,17 +14638,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9705,17 +14669,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9725,17 +14700,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -9745,17 +14733,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9763,25 +14764,36 @@
     "description": "A project's base role was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_project_base_role",
       "new_project_base_role",
       "project_number",
       "public_project",
-      "business",
       "project_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9789,20 +14801,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -9812,25 +14835,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -9838,20 +14873,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9859,25 +14906,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9885,17 +14944,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9903,17 +14975,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9921,18 +15006,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -9941,18 +15038,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -9961,19 +15070,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -9981,17 +15101,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -10003,22 +15136,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -10026,19 +15168,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10046,17 +15199,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10064,18 +15230,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -10083,20 +15262,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10104,18 +15293,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -10124,18 +15325,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -10144,16 +15357,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -10165,21 +15391,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -10187,22 +15425,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -10211,29 +15459,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10241,24 +15494,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "repo_id",
-      "user_id",
       "@timestamp",
-      "user_agent",
-      "repo",
-      "name",
-      "org_id",
-      "user",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -10269,21 +15530,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -10294,22 +15565,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10317,24 +15598,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "actor",
-      "oauth_application_id",
-      "authorized_actors_only",
-      "authorized_actors",
-      "created_at",
-      "user_agent",
-      "name",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "authorized_actors_only",
+      "authorized_actors",
+      "created_at",
+      "name",
+      "operation_type"
     ]
   },
   {
@@ -10342,30 +15633,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -10375,28 +15673,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -10407,23 +15713,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -10431,22 +15746,32 @@
     "description": "Branch deletion was enabled or disabled for a protected branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "operation_type",
-      "request_id",
-      "repo",
       "@timestamp",
-      "org_id",
-      "org",
-      "action",
-      "allow_deletions_enforcement_level",
       "_document_id",
-      "created_at",
-      "actor_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_deletions_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10454,23 +15779,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "actor_id",
-      "name",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo",
-      "operation_type",
-      "request_id",
-      "allow_force_pushes_enforcement_level",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_force_pushes_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10478,24 +15812,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -10504,22 +15847,32 @@
     "description": "Required linear commit history was enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "operation_type",
       "actor",
-      "linear_history_requirement_enforcement_level",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "linear_history_requirement_enforcement_level",
       "name",
-      "org_id",
-      "repo_id",
-      "org",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -10527,24 +15880,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "lock_allows_fetch_and_merge",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10553,27 +15915,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10582,18 +15951,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -10604,24 +15986,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -10629,25 +16020,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -10655,22 +16053,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -10678,22 +16086,33 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
   },
@@ -10702,22 +16121,32 @@
     "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "required_approving_review_count",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10725,25 +16154,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
     ]
   },
   {
@@ -10751,22 +16187,32 @@
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
       "action",
       "actor",
       "actor_id",
-      "signature_requirement_enforcement_level",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "programmatic_access_type"
+      "operation_type",
+      "name",
+      "created_at",
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -10774,22 +16220,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "created_at",
-      "repo_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "name",
-      "actor",
-      "repo",
       "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
+      "strict_required_status_checks_policy"
     ]
   },
   {
@@ -10797,23 +16253,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -10822,24 +16289,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -10848,20 +16326,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10870,21 +16362,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -10894,22 +16399,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10918,25 +16435,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10945,23 +16472,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
-      "created_at",
-      "key",
-      "fingerprint",
-      "actor_id",
       "actor",
-      "title",
-      "user_agent",
-      "user_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "read_only",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "key",
+      "fingerprint",
+      "title",
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10970,18 +16508,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -10991,21 +16543,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -11014,19 +16577,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -11037,23 +16613,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -11063,17 +16651,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11081,19 +16683,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -11101,19 +16716,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -11123,21 +16751,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -11146,27 +16785,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
-      "pull_request_url",
-      "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
+      "pull_request_url",
+      "pull_request_title",
+      "public_repo",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -11174,23 +16820,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -11199,18 +16857,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -11218,19 +16890,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -11240,20 +16924,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
-      "repo",
-      "created_at",
-      "request_id",
-      "comment_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "comment_id",
+      "operation_type"
     ]
   },
   {
@@ -11261,18 +16956,31 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "_document_id",
-      "@timestamp",
-      "comment_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "comment_id"
     ]
   },
   {
@@ -11280,21 +16988,33 @@
     "description": "A review on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -11302,20 +17022,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -11324,19 +17057,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -11346,45 +17093,64 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "created_at",
-      "user_agent",
-      "actor",
-      "action",
-      "repo",
-      "visibility",
       "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
-    ],
-    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
-  },
-  {
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility",
+      "previous_visibility"
+    ],
+    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
+  },
+  {
     "action": "repo.actions_enabled",
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -11393,25 +17159,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -11420,23 +17193,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -11445,24 +17226,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -11471,23 +17259,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -11497,22 +17293,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -11521,19 +17326,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11542,24 +17360,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -11568,24 +17396,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11593,24 +17429,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11618,24 +17462,32 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11643,24 +17495,32 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11668,23 +17528,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11695,17 +17564,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -11715,17 +17596,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -11735,25 +17628,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11762,26 +17661,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11790,25 +17697,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "query_suite",
-      "threat_model",
-      "languages",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "query_suite",
+      "threat_model",
+      "languages",
+      "public_repo",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -11818,19 +17734,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to this repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -11839,19 +17766,30 @@
     "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11859,17 +17797,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11878,15 +17829,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -11897,16 +17861,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11916,17 +17893,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11936,19 +17926,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11957,17 +17958,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11976,27 +17990,33 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "public_repo",
+      "created_at",
+      "operation_type"
+    ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
   {
@@ -12004,30 +18024,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -12037,20 +18062,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12059,25 +18095,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12086,23 +18130,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12110,25 +18165,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -12138,23 +18202,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -12164,24 +18237,32 @@
     "description": "The setting for immutable releases was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -12190,20 +18271,30 @@
     "description": "The setting for immutable releases was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12214,23 +18305,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -12238,21 +18339,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12260,21 +18371,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -12282,22 +18403,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -12305,21 +18435,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -12327,20 +18467,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -12348,22 +18499,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12371,18 +18531,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -12390,22 +18564,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -12413,21 +18597,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12435,18 +18629,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -12455,22 +18661,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12479,24 +18694,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12505,23 +18728,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12529,26 +18762,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -12557,21 +18795,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -12580,25 +18827,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12606,22 +18859,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -12630,25 +18893,34 @@
     "description": "A branch was renamed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "old_branch",
-      "new_branch",
-      "default_branch",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "old_branch",
+      "new_branch",
+      "default_branch",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch"
@@ -12658,19 +18930,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12678,17 +18961,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12697,17 +18995,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12716,7 +19029,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -12731,22 +19065,30 @@
     "description": "The cache retention policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12758,22 +19100,30 @@
     "description": "The cache storage policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12785,23 +19135,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -12811,20 +19170,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -12835,21 +19205,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -12858,22 +19239,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -12882,21 +19273,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -12905,22 +19307,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -12931,16 +19343,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
       "created_at",
-      "actor",
-      "repo_id",
-      "action",
-      "org",
-      "org_id",
-      "request_id",
-      "repo",
       "operation_type"
     ]
   },
@@ -12950,22 +19373,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -12974,23 +19408,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -13000,19 +19444,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -13020,21 +19474,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -13043,24 +19507,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13068,25 +19541,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -13095,24 +19575,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13121,25 +19611,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -13148,22 +19646,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13172,26 +19679,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -13199,31 +19714,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13232,22 +19754,30 @@
     "description": "Someone closed a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories",
     "fields": [
-      "actor",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "created_at",
-      "repo_id",
-      "_document_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "About repository security advisories"
   },
@@ -13256,18 +19786,29 @@
     "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "_document_id",
+      "operation_type",
       "created_at"
     ]
   },
@@ -13276,17 +19817,30 @@
     "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -13295,21 +19849,30 @@
     "description": "GitHub withdrew a security advisory that was published in error.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13317,18 +19880,30 @@
     "description": "Someone opened a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
       "repo_id",
-      "action",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13336,21 +19911,30 @@
     "description": "Someone published a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "repo_id",
       "_document_id",
-      "repo",
-      "business_id",
-      "business",
-      "request_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "org"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13358,17 +19942,30 @@
     "description": "Someone reopened as draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "repo",
-      "action",
+      "operation_type",
       "created_at",
-      "@timestamp",
-      "request_id",
-      "actor_id",
-      "_document_id",
-      "actor",
-      "repo_id",
       "public_repo"
     ]
   },
@@ -13377,21 +19974,30 @@
     "description": "Someone edited a draft or published security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "repo_id",
-      "org_id",
       "business",
-      "actor",
-      "user_agent",
-      "created_at",
-      "_document_id",
       "business_id",
-      "repo",
-      "action",
-      "operation_type",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13399,24 +20005,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -13425,24 +20037,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -13451,25 +20069,31 @@
     "description": "Code security was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13478,25 +20102,31 @@
     "description": "Code security was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13505,19 +20135,30 @@
     "description": "Data use settings were disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "repo_id",
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -13526,21 +20167,30 @@
     "description": "Data use settings were enabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "org",
-      "user_id",
-      "repo_id",
       "@timestamp",
-      "request_id",
-      "actor",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org_id",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -13549,23 +20199,30 @@
     "description": "The dependency graph was disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "repo_id",
-      "operation_type",
-      "user_id",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
-      "@timestamp",
-      "org_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -13574,24 +20231,31 @@
     "description": "The dependency graph was enabled for a private repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "org_id",
-      "action",
-      "repo",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor_id",
-      "repo_id",
+      "created_at",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13600,19 +20264,29 @@
     "description": "Dependency updates on self-hosted runners was disabled.",
     "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -13623,23 +20297,32 @@
     "description": "Dependency updates on self-hosted runners was enabled.",
     "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners",
     "fields": [
-      "topic",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "topic",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -13650,21 +20333,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -13672,21 +20365,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13694,21 +20397,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -13716,20 +20430,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -13737,21 +20463,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13759,19 +20496,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -13779,17 +20529,31 @@
     "description": "An organization has reached their repository limit.",
     "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "limit",
       "count",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -13800,17 +20564,31 @@
     "description": "An organization is approaching their repository limit.",
     "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "limit",
       "count",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -13821,19 +20599,30 @@
     "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise  Organization owners can now control their repository projects settings.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "user_agent",
-      "user",
-      "business_id",
-      "business",
-      "operation_type",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -13842,20 +20631,30 @@
     "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
       "@timestamp",
-      "repo",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "repo_id",
-      "actor",
-      "request_id",
-      "programmatic_access_type"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13864,20 +20663,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
       "created_at",
-      "org_id",
-      "action",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "actor_id",
-      "repo"
+      "operation_type"
     ]
   },
   {
@@ -13885,31 +20693,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -13918,19 +20734,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -13938,8 +20765,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -13948,23 +20774,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -13989,26 +20824,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -14017,26 +20858,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -14044,24 +20891,31 @@
     "action": "repository_secret_scanning_custom_pattern.create",
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
-    "fields": [
-      "user_agent",
-      "request_id",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14071,23 +20925,30 @@
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14097,24 +20958,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14124,24 +20992,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -14150,24 +21025,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14177,23 +21059,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14203,23 +21092,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14228,22 +21125,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14251,25 +21156,31 @@
     "description": "Metadata for secret scanning alerts has been disabled at the repository level",
     "docs_reference_links": "/code-security/secret-scanning/enabling-secret-scanning-features/enabling-extended-metadata-checks-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enabling extended metadata checks for your repository"
@@ -14279,24 +21190,32 @@
     "description": "Generic secrets have been disabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14304,22 +21223,31 @@
     "description": "Generic secrets have been enabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14328,24 +21256,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -14354,24 +21290,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -14380,19 +21324,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14401,24 +21357,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14427,24 +21391,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14453,19 +21425,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14474,26 +21458,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "public_repo",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14502,26 +21491,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14530,28 +21524,36 @@
     "description": "A code security configuration was applied to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14559,27 +21561,35 @@
     "description": "A code security configuration failed to attach to the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14587,28 +21597,36 @@
     "description": "A code security configuration was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14616,28 +21634,36 @@
     "description": "A code security configuration was removed due to a change in repository or enterprise settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14645,19 +21671,29 @@
     "description": "Dependabot security updates was disabled.",
     "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -14668,27 +21704,31 @@
     "description": "Dependabot security updates was enabled.",
     "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -14699,20 +21739,30 @@
     "description": "The repository visibility change setting was cleared for an organization or enterprise.",
     "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
       "business",
-      "action",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business_id",
-      "@timestamp",
       "user_agent",
-      "actor",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise"
   },
@@ -14721,20 +21771,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org_id",
-      "created_at",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "org",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
       "user_id",
-      "action",
-      "request_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14742,19 +21802,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "_document_id",
       "@timestamp",
-      "user_agent",
-      "user",
-      "created_at",
-      "org",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14762,29 +21833,37 @@
     "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -14793,29 +21872,37 @@
     "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -14824,19 +21911,32 @@
     "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
-      "operation_type",
-      "request_id",
-      "repo_id",
       "@timestamp",
-      "user_agent",
-      "alert_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "alert_id",
+      "created_at",
+      "alert_number"
     ],
     "docs_reference_titles": "About Dependabot alerts"
   },
@@ -14845,23 +21945,32 @@
     "description": "A Dependabot alert was manually dismissed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "alert_id",
-      "actor",
-      "repo",
       "created_at",
-      "org",
-      "_document_id",
-      "action",
-      "actor_id",
       "dismiss_reason",
-      "user",
       "dismiss_comment",
       "alert_number",
       "actor_is_bot"
@@ -14872,21 +21981,33 @@
     "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "public_repo",
       "owner",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "token_scopes",
       "alert_number"
     ]
   },
@@ -14895,26 +22016,34 @@
     "description": "A Dependabot alert was manually reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo",
-      "alert_number",
-      "request_access_security_header"
+      "alert_number"
     ]
   },
   {
@@ -14922,21 +22051,32 @@
     "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "alert_id",
-      "repo",
-      "operation_type",
-      "action",
-      "repo_id",
-      "_document_id",
-      "user_agent",
-      "request_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "operation_type",
+      "created_at",
+      "alert_number"
     ]
   },
   {
@@ -14944,21 +22084,35 @@
     "description": "A Dependabot alert was withdrawn.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
       "created_at",
       "active",
-      "action",
-      "repository_id",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type"
     ]
   },
@@ -14967,20 +22121,30 @@
     "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
     "fields": [
-      "org",
+      "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
-      "operation_type",
-      "created_at",
-      "actor",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
   },
@@ -14989,24 +22153,31 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -15014,26 +22185,32 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15041,23 +22218,30 @@
     "description": "Dependabot alerts was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "request_id",
-      "repo_id",
-      "action",
-      "actor_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "_document_id",
       "user_id",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15065,23 +22249,30 @@
     "description": "Dependabot alerts was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_agent",
-      "created_at",
       "@timestamp",
-      "repo_id",
+      "_document_id",
       "action",
-      "user",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor_id",
-      "_document_id",
-      "user_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -15090,24 +22281,31 @@
     "description": "A status check was marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "org",
-      "actor_id",
       "@timestamp",
-      "business",
-      "request_id",
-      "context",
-      "repo_id",
-      "action",
-      "repo",
       "_document_id",
-      "operation_type",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "created_at",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "context",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -15116,21 +22314,31 @@
     "description": "A status check was no longer marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "actor_id",
-      "actor",
-      "created_at",
-      "context",
-      "operation_type",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "repo_id",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
       "repo",
-      "programmatic_access_type"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "context",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -15139,18 +22347,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "business",
-      "business_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -15159,19 +22380,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -15180,22 +22413,33 @@
     "description": "A new custom repository role was created.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "role_permissions",
       "old_role_permissions"
     ],
@@ -15206,23 +22450,34 @@
     "description": "A custom repository role was deleted.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing custom repository roles for an organization"
   },
@@ -15231,23 +22486,34 @@
     "description": "A custom repository role was edited.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "old_role_permissions",
       "old_base_role"
     ],
@@ -15258,14 +22524,28 @@
     "description": "A user was assigned to a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15280,14 +22560,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15301,14 +22595,28 @@
     "description": "A secret scanning alert was deleted by GitHub.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15324,14 +22632,28 @@
     "description": "A secret scanning alert was leaked in a public repo.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15346,38 +22668,62 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
   {
     "action": "secret_scanning_alert.report",
     "description": "A leaked secret was reported to the secret's provider by secret scanning.",
-    "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts",
-    "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+    "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "created_at",
@@ -15392,28 +22738,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -15421,25 +22776,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -15447,14 +22809,28 @@
     "description": "A user was unassigned from a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15469,14 +22845,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -15493,26 +22883,34 @@
     "description": "A request to close a secret scanning alert was approved by a user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "request_reviewer_comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15521,25 +22919,33 @@
     "description": "N/A",
     "docs_reference_links": "A reqeust to close a secret scanning alert was canceled by a user.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "A, reqeust, to, close, a, secret, scanning, alert, was, canceled, by, a, user."
@@ -15549,27 +22955,35 @@
     "description": "N/A",
     "docs_reference_links": "A user requested to close a secret scanning alert.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "reason",
       "comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "A, user, requested, to, close, a, secret, scanning, alert."
@@ -15579,26 +22993,34 @@
     "description": "A request to close a secret scanning alert was denied by a user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "request_reviewer_comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -15607,19 +23029,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15628,19 +23061,30 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15649,20 +23093,30 @@
     "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15671,19 +23125,30 @@
     "description": "Secret scanning was enabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15692,14 +23157,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -15717,25 +23196,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -15744,24 +23231,32 @@
     "description": "A user canceled a request to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
@@ -15771,24 +23266,32 @@
     "description": "A user pushed a commit containing a secret for which there is an approved secret scanning push protection bypass request.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
@@ -15798,25 +23301,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -15826,25 +23337,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -15853,22 +23372,35 @@
     "description": "A secret scanning scan has completed on this repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "repo_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "source",
       "type",
       "source_slug",
       "type_slug",
       "started_at",
       "completed_at",
-      "repo",
       "public_repo",
-      "org",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "secret_types",
@@ -15882,10 +23414,28 @@
     "description": "A security configuration was created",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15900,15 +23450,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15926,22 +23469,33 @@
     "description": "A default security configuration setting for new repositories was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15950,22 +23504,33 @@
     "description": "A default security configuration setting for new repositories was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15974,10 +23539,28 @@
     "description": "A security configuration was deleted",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15992,15 +23575,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -16017,15 +23593,30 @@
     "description": "A security configuration policy was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enforcement",
       "security_configuration_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16035,10 +23626,28 @@
     "description": "A security configuration was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -16053,15 +23662,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -16079,16 +23681,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16098,18 +23713,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "org",
-      "org_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -16118,16 +23746,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16137,15 +23778,28 @@
     "description": "An agreement for invoiced billing for GitHub Sponsors was signed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -16157,15 +23811,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -16175,15 +23842,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -16192,17 +23874,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -16211,17 +23906,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -16230,16 +23939,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -16249,14 +23971,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -16266,17 +24003,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -16285,17 +24035,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -16304,18 +24067,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16324,15 +24100,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -16342,16 +24132,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16359,15 +24162,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -16378,16 +24194,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -16397,17 +24226,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -16418,17 +24260,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -16439,18 +24294,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16460,16 +24326,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16479,16 +24358,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "sponsors_listing_id",
       "created_at",
       "operation_type"
     ]
@@ -16500,17 +24392,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16519,19 +24424,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16540,21 +24458,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "user",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
       "action",
-      "user_id",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "actor_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16563,19 +24490,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16584,15 +24522,28 @@
     "description": "Dependabot encrypted config was read.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "public_repo"
@@ -16603,20 +24554,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16624,18 +24589,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -16643,16 +24623,31 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "domain_name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16660,23 +24655,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16684,23 +24689,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16708,23 +24723,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16732,23 +24757,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16756,21 +24791,31 @@
     "description": "A member of an organization was added to a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
-      "user",
       "@timestamp",
-      "actor_id",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "org",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -16780,22 +24825,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -16804,20 +24858,30 @@
     "description": "A team was added to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team_type",
       "team",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -16828,20 +24892,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -16850,18 +24925,31 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
       "created_at",
       "operation_type",
-      "actor_id",
-      "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
@@ -16871,21 +24959,32 @@
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -16894,21 +24993,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -16917,19 +25026,31 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "team",
       "org_id",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
       "operation_type",
-      "_document_id",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -16938,19 +25059,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "actor",
-      "action",
-      "operation_type",
-      "team",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -16958,19 +25091,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "actor_id",
       "_document_id",
-      "team",
-      "created_at",
-      "org_id",
       "action",
-      "request_id",
-      "user_agent",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_access_security_header"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "team",
+      "created_at"
     ]
   },
   {
@@ -16978,22 +25123,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "team",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17001,22 +25155,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -17025,20 +25188,30 @@
     "description": "A team was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team_type",
       "team",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -17049,22 +25222,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -17074,43 +25256,64 @@
     "description": "A repository was removed from a team's control.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "org",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
     "action": "team.rename",
-    "description": "A team's name was changed.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "name",
-      "user_agent",
-      "created_at",
-      "team",
-      "operation_type",
-      "actor_id",
-      "org",
+    "description": "A team's name was changed.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -17119,17 +25322,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -17138,19 +25354,30 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -17159,19 +25386,30 @@
     "description": "The Okta credentials for team synchronization with a tenant were changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -17179,28 +25417,37 @@
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
       "operation_type",
       "created_at",
-      "user_agent",
       "permission",
       "new_repo_permission",
       "new_repo_base_role",
       "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_repo_base_role"
     ]
   },
   {
@@ -17208,23 +25455,38 @@
     "description": "Triggered when a user content edit is deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_content_id",
       "user_content_type",
       "created_at",
-      "user_agent",
       "deleted_by",
       "editor_id",
-      "_document_id",
       "deleted_at",
-      "action",
-      "actor_id",
       "editor",
       "deleted_by_id",
       "deleted_content",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -17232,16 +25494,30 @@
     "description": "A Dependabot rule was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17251,16 +25527,30 @@
     "description": "A Dependabot rule was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17270,18 +25560,31 @@
     "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17291,21 +25594,33 @@
     "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17313,21 +25628,32 @@
     "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -17335,21 +25661,32 @@
     "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -17357,16 +25694,30 @@
     "description": "A Dependabot rule's conditions, actions, or metadata changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17376,27 +25727,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -17405,23 +25762,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17429,10 +25796,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17443,20 +25828,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -17465,23 +25839,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17491,10 +25873,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17506,19 +25906,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -17529,10 +25919,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17541,21 +25949,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -17565,23 +25962,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -17590,22 +25999,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -17613,21 +26033,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -17635,25 +26066,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -17661,23 +26100,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -17691,24 +26143,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -17717,10 +26178,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17730,21 +26209,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -17754,25 +26223,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/fpt/user.json b/src/audit-logs/data/fpt/user.json
index d12883c8b51a..86bcc2b8bf74 100644
--- a/src/audit-logs/data/fpt/user.json
+++ b/src/audit-logs/data/fpt/user.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,17 +67,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
-      "user_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -61,18 +98,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
+      "token_scopes",
       "user",
-      "request_id",
-      "_document_id",
-      "user_agent",
-      "actor",
       "user_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -80,18 +129,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "token_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -99,29 +160,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -129,18 +196,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -148,21 +227,34 @@
     "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -178,22 +270,34 @@
     "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "uuid",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -201,25 +305,37 @@
     "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
-      "request_access_security_header",
       "old_target_amount",
       "old_budget_limit_type",
       "old_alert_enabled",
@@ -233,17 +349,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -252,19 +381,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -273,15 +414,28 @@
     "description": "Azure subscription has been linked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -291,15 +445,28 @@
     "description": "Azure subscription has been unlinked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -309,18 +476,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -328,16 +508,28 @@
     "description": "The premium request paid usage policy for your GitHub account was changed.",
     "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -349,18 +541,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -368,15 +572,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -386,26 +603,36 @@
     "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -413,24 +640,34 @@
     "description": "A CSV export was requested on the \"Coverage\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -438,26 +675,36 @@
     "description": "A CSV export was requested on the \"Overview Dashboard\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "user",
-      "user_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -465,20 +712,31 @@
     "description": "A CSV export was requested on the \"Risk\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -489,17 +747,29 @@
     "description": "The cache retention policy for GitHub Actions was set for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -511,17 +781,29 @@
     "description": "The cache storage policy for GitHub Actions was set for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -533,17 +815,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -554,20 +849,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -576,19 +883,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -597,19 +917,31 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -618,20 +950,32 @@
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -640,19 +984,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -661,20 +1017,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -683,20 +1050,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -707,17 +1085,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -725,14 +1115,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -742,25 +1147,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -771,22 +1185,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -798,22 +1223,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -822,15 +1258,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -841,17 +1292,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -861,27 +1325,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "owner",
-      "pull_request_id",
-      "machine_type",
-      "user_id",
-      "user",
-      "devcontainer_path",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
+      "machine_type",
+      "devcontainer_path",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -889,19 +1362,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -909,18 +1395,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -929,23 +1427,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -953,16 +1458,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -971,24 +1490,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -996,15 +1521,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1014,20 +1552,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1035,19 +1583,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -1055,21 +1615,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1077,22 +1646,33 @@
     "description": "Specific repositories were disabled from using Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "owner_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1100,21 +1680,31 @@
     "description": "Specific repositories were enabled to use Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "owner_type",
-      "owner",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1124,20 +1714,32 @@
     "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_access",
       "old_access",
-      "org_id",
       "owner_type",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1147,21 +1749,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1171,19 +1782,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1193,21 +1813,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1217,19 +1846,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1238,19 +1878,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1259,19 +1910,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1280,19 +1942,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1301,25 +1974,33 @@
     "description": "Dismissal of Dependabot alerts was approved.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -1329,25 +2010,33 @@
     "description": "Dismissal request for Dependabot alerts was canceled.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -1357,25 +2046,33 @@
     "description": "Dismissal of Dependabot alerts was requested.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -1385,25 +2082,33 @@
     "description": "Dismissal of Dependabot alerts was denied.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -1413,17 +2118,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1431,19 +2149,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1452,19 +2181,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1472,19 +2212,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1493,19 +2244,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1513,19 +2275,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1534,19 +2307,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1554,19 +2338,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1575,20 +2370,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1596,22 +2401,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1620,22 +2434,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1643,28 +2467,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1673,27 +2503,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1702,25 +2540,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1729,26 +2575,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1757,21 +2610,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1780,22 +2645,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1804,25 +2679,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1831,22 +2715,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1855,21 +2751,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -1880,21 +2786,32 @@
     "description": "A gist was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "gist_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "visibility",
-      "action",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ]
   },
   {
@@ -1902,42 +2819,65 @@
     "description": "A gist was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "gist_id",
-      "visibility",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "user",
-      "request_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "user_agent",
-      "@timestamp",
-      "programmatic_access_type"
-    ]
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "gist_id",
+      "visibility",
+      "created_at",
+      "operation_type"
+    ]
   },
   {
     "action": "gist.visibility_change",
     "description": "The visibility of a gist was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "user",
-      "gist_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "visibility",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "gist_id",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -1945,22 +2885,33 @@
     "description": "An SSH key was added to a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1969,23 +2920,34 @@
     "description": "An SSH key was removed from a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
       "explanation",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1994,23 +2956,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2018,18 +2989,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2040,20 +3021,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2063,18 +3054,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "user",
-      "operation_type",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2082,18 +3085,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2101,25 +3116,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "name",
-      "events",
-      "active",
-      "active_was",
-      "hook_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "events",
+      "active",
+      "active_was",
+      "hook_id",
+      "operation_type"
     ]
   },
   {
@@ -2127,25 +3152,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -2153,26 +3187,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -2181,25 +3224,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -2207,26 +3259,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -2234,21 +3295,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -2257,19 +3329,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -2277,21 +3362,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -2300,19 +3396,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -2323,20 +3433,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2346,24 +3468,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2374,23 +3507,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2401,20 +3546,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2424,19 +3582,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -2445,20 +3617,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -2468,20 +3653,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -2490,20 +3688,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -2512,40 +3723,65 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "name",
-      "integration",
-      "user",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "integration.revoke_all_tokens",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "integration.revoke_all_tokens",
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2554,19 +3790,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2575,17 +3824,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2598,21 +3860,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -2626,17 +3901,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2648,20 +3936,30 @@
     "description": "An issue was marked as blocked by another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2672,19 +3970,30 @@
     "description": "The blocked by relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2694,20 +4003,30 @@
     "description": "An issue was marked as blocking another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2718,20 +4037,30 @@
     "description": "The blocking relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
+      "public_repo",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2742,18 +4071,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2761,21 +4102,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -2783,21 +4137,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2805,22 +4172,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -2828,19 +4208,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -2851,21 +4244,36 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
       "marketplace_listing",
       "has_free_trial",
-      "user_agent",
-      "request_id",
-      "actor_id",
       "yearly_price_in_cents",
       "description",
       "bullets",
       "monthly_price_in_cents",
-      "marketplace_listing_plan",
-      "_document_id"
+      "marketplace_listing_plan"
     ]
   },
   {
@@ -2873,22 +4281,37 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "marketplace_listing_plan",
       "marketplace_listing",
       "description",
       "bullets",
       "has_free_trial",
       "created_at",
-      "actor_id",
       "operation_type",
-      "_document_id",
-      "action",
-      "user_agent",
-      "request_id",
-      "actor",
       "monthly_price_in_cents",
-      "yearly_price_in_cents",
-      "@timestamp"
+      "yearly_price_in_cents"
     ]
   },
   {
@@ -2896,21 +4319,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "marketplace_listing_plan",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "marketplace_listing_plan",
       "description",
       "yearly_price_in_cents",
-      "@timestamp",
       "created_at",
-      "actor_id",
       "bullets",
       "has_free_trial",
       "marketplace_listing",
-      "user_agent",
       "monthly_price_in_cents",
-      "action",
       "operation_type"
     ]
   },
@@ -2919,45 +4357,73 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "monthly_price_in_cents",
-      "marketplace_listing",
+      "@timestamp",
       "_document_id",
       "action",
-      "description",
-      "bullets",
-      "yearly_price_in_cents",
-      "request_id",
-      "actor_id",
-      "has_free_trial",
-      "marketplace_listing_plan",
-      "user_agent",
-      "@timestamp",
-      "operation_type",
       "actor",
-      "created_at"
-    ]
-  },
-  {
-    "action": "marketplace_listing.redraft",
-    "description": "A listing was sent back to draft state.",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "monthly_price_in_cents",
+      "marketplace_listing",
+      "description",
+      "bullets",
+      "yearly_price_in_cents",
+      "has_free_trial",
+      "marketplace_listing_plan",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "marketplace_listing.redraft",
+    "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -2965,22 +4431,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2988,19 +4467,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3008,21 +4499,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3032,16 +4532,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3051,18 +4564,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3072,14 +4598,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -3087,19 +4629,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -3107,42 +4660,62 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "org",
-      "created_at",
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
-      "request_access_security_header"
-    ]
-  },
-  {
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
     "action": "migration.create",
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -3150,20 +4723,30 @@
     "description": "An OAuth access token was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
     "fields": [
-      "_document_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "user",
-      "user_id",
-      "created_at",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "request_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
@@ -3174,19 +4757,30 @@
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "explanation",
-      "hashed_token",
-      "actor_id",
-      "token_scopes",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
@@ -3196,19 +4790,30 @@
     "description": "An OAuth access token was regenerated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "_document_id",
-      "created_at",
       "@timestamp",
-      "operation_type",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ]
   },
@@ -3217,16 +4822,28 @@
     "description": "An OAuth access token was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "request_access_security_header",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
       "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3236,18 +4853,30 @@
     "description": "An OAuth access token was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3255,20 +4884,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3277,20 +4918,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3299,42 +4952,66 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application",
-      "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
-  },
-  {
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+  },
+  {
     "action": "oauth_application.remove_client_secret",
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3343,19 +5020,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3364,20 +5054,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3386,20 +5088,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3408,19 +5122,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3429,24 +5156,31 @@
     "description": "An authorization for an OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "user_id",
-      "actor",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
       "actor_id",
-      "user",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "actor_is_bot",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -3456,20 +5190,31 @@
     "description": "An authorization for an OAuth application was deleted.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "actor",
       "created_at",
       "explanation",
-      "user",
-      "user_id",
-      "org_id",
-      "action",
-      "actor_id",
-      "token_scopes",
       "actor_is_bot",
       "oauth_application_name"
     ],
@@ -3480,20 +5225,31 @@
     "description": "An authorization for an OAuth application was updated.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
-      "actor_id",
       "user_agent",
-      "@timestamp",
       "operation_type",
-      "action",
-      "user",
       "created_at",
-      "_document_id",
       "actor_is_bot",
-      "request_access_security_header",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -3503,21 +5259,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -3526,24 +5292,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3551,20 +5327,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3572,22 +5358,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3595,20 +5389,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3616,22 +5420,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3639,21 +5451,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3661,26 +5482,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -3689,26 +5519,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3716,28 +5554,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user",
-      "user_id",
-      "query",
-      "filename",
-      "requested_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "query",
+      "filename",
+      "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3745,26 +5591,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3772,18 +5626,28 @@
     "description": "The cache retention policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3795,18 +5659,28 @@
     "description": "The cache storage policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3818,20 +5692,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -3840,16 +5725,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -3860,18 +5758,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -3880,18 +5791,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -3900,18 +5823,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -3920,18 +5856,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -3941,20 +5889,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -3962,17 +5921,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -3982,20 +5954,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -4004,20 +5987,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -4026,17 +6023,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4047,20 +6059,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -4069,19 +6095,31 @@
     "description": "A new passkey was added.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4089,19 +6127,31 @@
     "description": "A new passkey was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4109,18 +6159,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4128,35 +6190,61 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "payment_method.update",
-    "description": "An existing payment method was updated.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "payment_method.update",
+    "description": "An existing payment method was updated.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4164,18 +6252,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4186,18 +6287,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4208,17 +6322,30 @@
     "description": "Triggered when you create a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4228,19 +6355,31 @@
     "description": "Triggered when you regenerate a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4248,12 +6387,29 @@
     "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
     "fields": [
-      "user_programmatic_access_name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
       "operation_type"
     ],
@@ -4264,20 +6420,32 @@
     "description": "Triggered when you delete a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "explanation",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4285,17 +6453,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -4306,18 +6487,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -4329,17 +6523,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -4351,17 +6558,30 @@
     "description": "A fine-grained personal access token was updated.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4372,15 +6592,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4390,17 +6625,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4410,15 +6656,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4428,17 +6689,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4448,17 +6720,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4468,17 +6751,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4488,17 +6782,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4508,17 +6813,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -4528,38 +6846,62 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "@timestamp"
-    ]
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "project.close",
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -4569,25 +6911,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -4595,20 +6949,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4616,25 +6982,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4642,17 +7020,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4660,17 +7051,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4678,18 +7082,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -4698,18 +7114,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -4718,19 +7146,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -4738,17 +7177,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -4760,22 +7212,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -4783,19 +7244,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4803,17 +7275,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4821,18 +7306,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -4840,20 +7338,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4861,18 +7369,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -4881,18 +7401,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -4901,16 +7433,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -4922,21 +7467,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
+      "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -4944,18 +7501,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4966,23 +7536,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -4991,24 +7572,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -5017,20 +7609,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -5039,21 +7645,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -5063,22 +7682,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -5087,25 +7718,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -5114,23 +7755,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -5139,22 +7791,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -5163,21 +7825,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -5186,25 +7857,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -5213,23 +7891,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -5238,24 +7924,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -5264,23 +7957,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -5290,22 +7991,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -5314,19 +8024,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -5335,24 +8058,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -5361,23 +8094,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -5388,17 +8130,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -5407,15 +8162,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -5426,16 +8194,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -5445,17 +8226,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -5465,19 +8259,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -5486,17 +8291,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -5505,26 +8323,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -5533,30 +8357,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -5566,20 +8395,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5588,25 +8428,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5615,23 +8463,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5639,25 +8498,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -5667,23 +8535,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -5691,21 +8569,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5713,21 +8601,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -5735,22 +8633,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5758,65 +8665,95 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
-      "actor",
-      "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
-      "repo",
       "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "repo.pages_private",
-    "description": "A GitHub Pages site visibility was changed to private.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id"
+      "visibility",
+      "operation_type"
     ]
   },
   {
-    "action": "repo.pages_public",
-    "description": "A GitHub Pages site visibility was changed to public.",
+    "action": "repo.pages_private",
+    "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "repo.pages_public",
+    "description": "A GitHub Pages site visibility was changed to public.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5824,18 +8761,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5843,22 +8794,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5866,21 +8827,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5888,18 +8859,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -5908,22 +8891,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5932,24 +8924,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5958,23 +8958,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5982,26 +8992,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -6010,21 +9025,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -6033,25 +9057,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -6059,22 +9089,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -6083,19 +9123,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6103,22 +9154,30 @@
     "description": "The cache retention policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -6130,22 +9189,30 @@
     "description": "The cache storage policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -6157,46 +9224,66 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "public_repo"
-    ],
-    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
-  },
-  {
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
+      "created_at",
+      "operation_type",
+      "public_repo"
+    ],
+    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
+  },
+  {
     "action": "repo.set_actions_private_fork_pr_approvals_policy",
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -6207,21 +9294,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -6230,22 +9328,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -6254,21 +9362,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -6277,22 +9396,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -6303,16 +9432,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -6321,22 +9461,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -6346,22 +9495,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -6370,23 +9530,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -6396,19 +9566,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -6416,21 +9596,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -6439,24 +9629,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -6464,25 +9663,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -6491,24 +9697,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6517,25 +9733,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -6544,22 +9768,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6568,26 +9801,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -6595,31 +9836,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "created_at",
-      "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
-      "operation_type",
-      "request_id",
-      "org_id",
       "actor_id",
-      "visibility",
-      "old_permission",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_id",
-      "old_base_role",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "visibility",
+      "old_permission",
+      "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6628,21 +9876,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -6650,21 +9908,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6672,21 +9940,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -6694,20 +9973,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6715,21 +10006,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6737,19 +10039,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -6757,31 +10072,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -6790,19 +10113,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -6810,8 +10144,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -6820,23 +10153,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -6861,18 +10203,30 @@
     "description": "A security key was registered for an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6880,18 +10234,30 @@
     "description": "A security key was removed from an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6899,14 +10265,28 @@
     "description": "A user linked a social identity to their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6916,14 +10296,28 @@
     "description": "A user unlinked a social identity from their account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6933,15 +10327,28 @@
     "description": "A user unlinked all social identities from their account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6951,16 +10358,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6970,18 +10390,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -6990,16 +10423,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -7010,15 +10456,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -7028,16 +10487,31 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
-      "user_id",
-      "@timestamp"
-    ],
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
   {
@@ -7045,17 +10519,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -7064,17 +10551,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -7083,16 +10584,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -7102,14 +10616,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -7119,17 +10648,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -7138,17 +10680,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -7157,18 +10712,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7177,15 +10745,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -7195,16 +10777,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7212,15 +10807,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -7231,16 +10839,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -7250,17 +10871,30 @@
     "description": "Triggered when you send an email update to your sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
     "fields": [
-      "request_id",
-      "actor",
-      "action",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
   },
@@ -7269,17 +10903,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -7290,17 +10937,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -7311,18 +10971,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -7332,16 +11003,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -7351,17 +11035,30 @@
     "description": "You join the waitlist to join GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "actor_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -7370,16 +11067,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -7389,23 +11099,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7413,23 +11133,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
+      "public_repo",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7437,23 +11167,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7461,23 +11201,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7485,15 +11235,30 @@
     "description": "Triggered when you accept a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7502,15 +11267,30 @@
     "description": "Triggered when you cancel a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7519,15 +11299,30 @@
     "description": "Triggered when you create a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7536,15 +11331,30 @@
     "description": "Triggered when you decline a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7553,15 +11363,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7569,15 +11394,30 @@
     "description": "Triggered when you revoke a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7586,17 +11426,30 @@
     "description": "A new trusted device was added.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7604,17 +11457,30 @@
     "description": "A trusted device was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7622,14 +11488,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "action",
-      "request_id",
-      "user_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -7638,15 +11519,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "created_at",
-      "user_id",
-      "operation_type",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7654,13 +11550,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "created_at",
-      "user_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7668,17 +11581,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "operation_type",
-      "action",
-      "_document_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7686,17 +11612,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7704,16 +11643,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7721,15 +11674,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "user",
       "_document_id",
-      "request_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7737,18 +11705,30 @@
     "description": "A secondary authentication factor was added to a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -7757,18 +11737,30 @@
     "description": "Two-factor authentication was disabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
     "fields": [
-      "actor",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_id",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Disabling two-factor authentication for your personal account"
   },
@@ -7777,18 +11769,30 @@
     "description": "Two-factor authentication was enabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
-      "actor",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Configuring two-factor authentication"
   },
@@ -7797,15 +11801,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user",
-      "user_id",
-      "action",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "user_agent"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7813,16 +11832,29 @@
     "description": "Two factor recovery codes were regenerated for a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
+      "operation_type",
       "created_at"
     ]
   },
@@ -7831,18 +11863,30 @@
     "description": "A secondary authentication factor was removed from a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -7851,15 +11895,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "created_at",
-      "_document_id",
-      "action",
-      "@timestamp"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7868,16 +11927,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "operation_type",
       "user_agent",
-      "action",
-      "request_id",
-      "actor",
-      "actor_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7885,19 +11957,31 @@
     "description": "An email address was added to a user account.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "actor_id",
-      "actor",
       "email",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding an email address to your GitHub account"
   },
@@ -7906,18 +11990,30 @@
     "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "created_at",
-      "user",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7925,15 +12021,28 @@
     "description": "Audit log entries were exported.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "action",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ]
@@ -7943,20 +12052,31 @@
     "description": "A user was blocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_id",
-      "_document_id",
       "actor_id",
-      "@timestamp",
-      "user_agent",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7964,18 +12084,30 @@
     "description": "A user changed their password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "actor_id",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7983,18 +12115,30 @@
     "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -8003,17 +12147,30 @@
     "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -8022,19 +12179,31 @@
     "description": "A new user account was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "email",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "created_at",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "programmatic_access_type"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "email",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8042,21 +12211,33 @@
     "description": "A user secret for Codespaces was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8064,20 +12245,31 @@
     "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "oauth_application_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "@timestamp",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -8085,18 +12277,30 @@
     "description": "A user account was destroyed by an asynchronous job.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8105,19 +12309,30 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "oauth_application_id",
+      "_document_id",
       "action",
-      "user",
-      "created_at",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8125,18 +12340,30 @@
     "description": "A user deleted his or her account, triggering user.async_delete.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
-      "created_at",
-      "user_agent",
       "user_id",
-      "operation_type",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8144,37 +12371,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "user_agent",
-      "user_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "operation_type",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "user.device_verification_requested",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
-      "operation_type",
+      "user_agent",
       "created_at",
-      "_document_id",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "user.device_verification_requested",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "user",
-      "actor_id",
+      "_document_id",
       "action",
-      "request_access_security_header"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8183,17 +12434,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "request_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8201,17 +12464,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8219,17 +12495,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8237,17 +12526,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8255,21 +12557,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8277,21 +12589,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -8300,17 +12622,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8318,17 +12653,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8336,17 +12684,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8354,18 +12715,30 @@
     "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "org_id",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8373,17 +12746,31 @@
     "description": "A user requested a password reset.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
     "fields": [
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "email",
-      "created_at",
-      "user_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
   },
@@ -8392,17 +12779,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "created_at",
-      "user_agent",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "request_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8410,18 +12810,30 @@
     "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -8430,19 +12842,31 @@
     "description": "A user signed in.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "actor_id",
       "@timestamp",
-      "user",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "actor",
-      "passkey_nickname",
-      "request_access_security_header"
+      "passkey_nickname"
     ]
   },
   {
@@ -8450,18 +12874,30 @@
     "description": "A user signed out.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8469,18 +12905,30 @@
     "description": "A user signed in from a new device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8488,21 +12936,31 @@
     "description": "An ordinary user account was promoted to a site administrator.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
+      "user_id",
       "user_agent",
+      "created_at",
       "oauth_application_id",
-      "request_id",
-      "operation_type",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8510,16 +12968,29 @@
     "description": "A user's account was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user",
-      "action",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "operation_type"
     ]
   },
@@ -8528,20 +12999,31 @@
     "description": "An email address was removed from a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "actor_id",
       "created_at",
-      "email",
-      "token_scopes",
-      "programmatic_access_type"
+      "email"
     ]
   },
   {
@@ -8549,20 +13031,32 @@
     "description": "A user secret for Codespaces was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "key",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8570,20 +13064,31 @@
     "description": "A username was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "request_id",
-      "actor_id",
-      "old_login",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_login",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8591,18 +13096,30 @@
     "description": "A user reset their account password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8610,16 +13127,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -8630,16 +13160,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -8648,18 +13190,30 @@
     "description": "A user signed in from an unrecognized device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor",
-      "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8667,18 +13221,30 @@
     "description": "A user signed in from an unrecognized device and location.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "created_at",
-      "_document_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8686,22 +13252,33 @@
     "description": "Triggered when you clear the status on your profile.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "message",
-      "user",
-      "actor_id",
       "created_at",
-      "request_id",
       "limited_availability",
-      "action",
       "emoji",
-      "operation_type",
-      "user_agent",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8709,23 +13286,33 @@
     "description": "Triggered when you set or change the status on your profile.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
     "fields": [
-      "limited_availability",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "message",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "emoji",
-      "org",
-      "actor",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "limited_availability",
+      "message",
+      "created_at",
+      "emoji",
+      "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
   },
@@ -8734,21 +13321,31 @@
     "description": "A user account was suspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "user_agent",
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "token_scopes",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8756,18 +13353,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
-      "actor_id",
       "@timestamp",
-      "operation_type",
       "_document_id",
-      "user_agent",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8775,18 +13384,30 @@
     "description": "A 2FA challenge issued for a user account failed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "actor_id",
-      "actor",
-      "user_id",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8796,16 +13417,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
       "user_agent",
-      "request_id",
-      "action",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8813,18 +13446,30 @@
     "description": "A user used their 2FA recovery codes.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8832,18 +13477,30 @@
     "description": "A user downloaded 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8851,17 +13508,30 @@
     "description": "A user printed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8869,18 +13539,30 @@
     "description": "A user viewed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
       "created_at",
-      "user",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8888,17 +13570,30 @@
     "description": "A user was prompted for a two-factor authentication code.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
     "fields": [
-      "user",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "actor"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
   },
@@ -8907,19 +13602,31 @@
     "description": "A user was unblocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "user_agent",
-      "user_id",
-      "user",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8927,21 +13634,31 @@
     "description": "A user account was unsuspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "user_agent",
       "actor",
-      "oauth_application_id",
-      "operation_type",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "user_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8949,21 +13666,33 @@
     "description": "A user secret for Codespaces was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8971,46 +13700,64 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "workflows.approve_workflow_job",
+    "description": "A workflow job was approved.",
+    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "workflows.approve_workflow_job",
-    "description": "A workflow job was approved.",
-    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
-    "fields": [
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "workflow_run_id",
       "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -9019,23 +13766,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9043,23 +13800,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9069,23 +13834,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -9094,22 +13871,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9117,21 +13905,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -9139,25 +13938,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9165,24 +13972,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -9191,25 +14007,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghec/enterprise.json b/src/audit-logs/data/ghec/enterprise.json
index c97a1bf551dc..2c4795b8b6ca 100644
--- a/src/audit-logs/data/ghec/enterprise.json
+++ b/src/audit-logs/data/ghec/enterprise.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,29 +67,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -72,21 +103,32 @@
     "description": "Credit was accepted for a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Editing a repository security advisory"
   },
@@ -95,21 +137,32 @@
     "description": "Someone was added to the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -117,21 +170,32 @@
     "description": "Credit was declined for a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -140,21 +204,32 @@
     "description": "Someone was removed from the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -163,31 +238,34 @@
     "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "query_string",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "request_body",
-      "status_code",
-      "url_path",
       "business",
       "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "request_method",
+      "query_string",
+      "request_body",
+      "status_code",
+      "url_path",
+      "public_repo",
       "created_at",
       "operation_type",
       "route",
@@ -201,18 +279,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -220,20 +310,32 @@
     "description": "A manual check of the endpoint configured for audit log streaming was performed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "audit_log_stream_result",
-      "business_id",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_result",
       "created_at",
       "operation_type",
-      "audit_log_stream_sink_details",
-      "request_access_security_header"
+      "audit_log_stream_sink_details"
     ]
   },
   {
@@ -241,16 +343,29 @@
     "description": "An endpoint was added for audit log streaming.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "business_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "audit_log_stream_sink",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "audit_log_stream_id"
@@ -261,15 +376,28 @@
     "description": "An audit log streaming endpoint was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "business_id",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "audit_log_stream_id",
@@ -281,17 +409,30 @@
     "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "audit_log_stream_enabled",
-      "business_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_enabled",
       "audit_log_stream_sink",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "new_s3_bucket",
@@ -314,17 +455,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -335,20 +487,30 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
   },
@@ -357,21 +519,34 @@
     "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -387,22 +562,34 @@
     "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "uuid",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -410,25 +597,37 @@
     "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
-      "request_access_security_header",
       "old_target_amount",
       "old_budget_limit_type",
       "old_alert_enabled",
@@ -442,17 +641,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -461,19 +673,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
-      "org_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -482,15 +706,28 @@
     "description": "Azure subscription has been linked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -500,15 +737,28 @@
     "description": "Azure subscription has been unlinked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -518,18 +768,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -537,16 +800,28 @@
     "description": "The premium request paid usage policy for your GitHub account was changed.",
     "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -558,18 +833,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -577,15 +864,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -595,22 +895,31 @@
     "description": "An enterprise owner was added to an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
     "fields": [
-      "name",
-      "business",
-      "user",
-      "user_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "request_id",
+      "business",
       "business_id",
-      "_document_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Inviting people to manage your enterprise"
   },
@@ -619,20 +928,31 @@
     "description": "A billing manager was added to an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
       "business",
       "business_id",
-      "action",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -640,20 +960,30 @@
     "description": "An enterprise prevented access to resources by users with the given two-factor method.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
-      "two_factor_method",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "two_factor_method",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -664,22 +994,32 @@
     "description": "An organization was added to an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
-      "actor",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "operation_type",
       "name",
       "created_at",
-      "request_id",
-      "_document_id",
-      "business",
-      "organization_upgrade",
-      "request_access_security_header"
+      "organization_upgrade"
     ]
   },
   {
@@ -687,20 +1027,31 @@
     "description": "A support entitlement was added to a member of an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/managing-support-entitlements-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing support entitlements for your enterprise"
   },
@@ -709,20 +1060,30 @@
     "description": "GitHub Advanced Security was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -731,17 +1092,28 @@
     "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -752,21 +1124,31 @@
     "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -775,17 +1157,28 @@
     "description": "GitHub Advanced Security was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -796,17 +1189,28 @@
     "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -817,21 +1221,31 @@
     "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -840,15 +1254,28 @@
     "description": "Enablement for Advanced Security features on new repositories has been locked for this enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -859,15 +1286,28 @@
     "description": "Enablement for Advanced Security features on new repositories has been unlocked for this enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -878,42 +1318,66 @@
     "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "new_policy",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "new_policy",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
   {
     "action": "business.advanced_security_repo_admin_enablement_policy_update",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -921,17 +1385,28 @@
     "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -943,21 +1418,31 @@
     "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -966,17 +1451,30 @@
     "description": "An export of the enterprise audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
     "docs_reference_links": "admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/exporting-audit-log-activity-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "business",
-      "business_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor",
-      "action",
-      "_document_id",
       "query_phrase"
     ],
     "docs_reference_titles": "Exporting audit log activity for your enterprise"
@@ -986,19 +1484,32 @@
     "description": "An export of the enterprise's Git events was created.",
     "docs_reference_links": "admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/exporting-audit-log-activity-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "start",
       "end",
-      "business",
-      "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Exporting audit log activity for your enterprise"
   },
@@ -1007,21 +1518,32 @@
     "description": "An invitation for someone to be an owner of an enterprise was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "invitation_id",
-      "user_id",
-      "_document_id",
       "operation_type",
       "created_at",
-      "name",
-      "request_id",
-      "actor",
-      "@timestamp",
-      "business",
-      "business_id",
-      "action"
+      "name"
     ]
   },
   {
@@ -1029,21 +1551,32 @@
     "description": "An invitation for someone to be an billing manager of an enterprise was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "action",
       "@timestamp",
-      "actor",
-      "name",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
       "business",
-      "user_id",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "invitation_id",
-      "user"
+      "name",
+      "created_at",
+      "operation_type",
+      "invitation_id"
     ]
   },
   {
@@ -1051,16 +1584,29 @@
     "description": "The trial of GitHub Enterprise Cloud was canceled.",
     "docs_reference_links": "/admin/overview/setting-up-a-trial-of-github-enterprise-cloud",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type"
     ],
@@ -1071,18 +1617,31 @@
     "description": "The seats plan type was changed for an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "seats_plan_type_was",
       "seats_plan_type",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1093,18 +1652,31 @@
     "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1113,17 +1685,30 @@
     "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
     "fields": [
-      "name",
-      "operation_type",
-      "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "actor",
+      "@timestamp",
       "_document_id",
-      "business",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -1133,17 +1718,29 @@
     "description": "Cleared two-factor authentication restrictions for an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1154,19 +1751,32 @@
     "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
-      "action",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "business",
       "visibility",
       "created_at",
-      "actor",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -1175,21 +1785,33 @@
     "description": "The policy for Code scanning autofix was updated for an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1197,21 +1819,33 @@
     "description": "The policy for Code scanning autofix third party tools was updated for an enterprise.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/getting-started/github-security-features#available-with-github-code-security"
   },
@@ -1220,18 +1854,30 @@
     "description": "The policy for Code Security enablement was updated for an enterprise.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1243,15 +1889,28 @@
     "description": "Enablement for Code Security features on new repositories has been locked for this enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1262,15 +1921,28 @@
     "description": "Enablement for Code Security features on new repositories has been unlocked for this enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1281,32 +1953,62 @@
     "description": "Server statistics were exported for the enterprise.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type"
-    ],
-    "docs_reference_titles": "Exporting Server Statistics"
-  },
-  {
-    "action": "business.convert_trial",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "Exporting Server Statistics"
+  },
+  {
+    "action": "business.convert_trial",
     "description": "The enterprise account on a trial of GitHub Enterprise Cloud was upgraded to a paid enterprise account.",
     "docs_reference_links": "/admin/overview/setting-up-a-trial-of-github-enterprise-cloud",
     "fields": [
-      "name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type"
     ],
@@ -1317,19 +2019,31 @@
     "description": "An enterprise was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "request_id",
-      "name",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "operation_type",
-      "actor",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1337,16 +2051,29 @@
     "description": "A trial of GitHub Enterprise Cloud began.",
     "docs_reference_links": "/admin/overview/setting-up-a-trial-of-github-enterprise-cloud",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type"
     ],
@@ -1357,16 +2084,29 @@
     "description": "The enterprise was deleted.",
     "docs_reference_links": "/admin/overview/deleting-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
       "business",
-      "action",
       "business_id",
-      "@timestamp",
-      "operation_type",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "name",
       "created_at"
     ],
@@ -1377,17 +2117,28 @@
     "description": "Dependabot alerts were disabled for your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1397,17 +2148,28 @@
     "description": "Dependabot alerts were enabled for your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1417,17 +2179,28 @@
     "description": "Dependabot alerts were disabled for new repositories in your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1437,17 +2210,28 @@
     "description": "Dependabot alerts were enabled for new repositories in your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1457,17 +2241,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1477,38 +2274,62 @@
     "description": "OIDC single sign-on was disabled for an enterprise.",
     "docs_reference_links": "/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/configuring-oidc-for-enterprise-managed-users",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "Configuring OIDC for Enterprise Managed Users"
-  },
-  {
-    "action": "business.disable_open_scim",
-    "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "Configuring OIDC for Enterprise Managed Users"
+  },
+  {
+    "action": "business.disable_open_scim",
+    "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1516,18 +2337,31 @@
     "description": "SAML single sign-on was disabled for an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "_document_id",
       "issuer",
-      "@timestamp",
-      "actor_id",
       "name",
       "sso_url"
     ]
@@ -1537,17 +2371,28 @@
     "description": "Display of IP addresses within audit log events for the enterprise was disabled.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1558,18 +2403,31 @@
     "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "business_id",
-      "actor_id",
-      "name",
-      "_document_id",
-      "request_id"
+      "name"
     ]
   },
   {
@@ -1577,15 +2435,28 @@
     "description": "OIDC single sign-on was enabled for an enterprise.",
     "docs_reference_links": "/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/configuring-oidc-for-enterprise-managed-users",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1596,15 +2467,28 @@
     "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1614,20 +2498,33 @@
     "description": "SAML single sign-on was enabled for an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
-      "sso_url",
       "@timestamp",
-      "issuer",
-      "action",
-      "actor_id",
       "_document_id",
-      "request_id",
-      "created_at",
+      "action",
       "actor",
-      "business_id",
+      "actor_id",
       "business",
-      "user_agent"
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "sso_url",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -1635,17 +2532,28 @@
     "description": "Display of IP addresses within audit log events for the enterprise was enabled.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1656,18 +2564,31 @@
     "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "operation_type",
-      "created_at",
+      "actor_id",
       "business",
       "business_id",
-      "name",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ]
   },
   {
@@ -1675,19 +2596,30 @@
     "description": "A GitHub Enterprise Server license was downloaded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
-      "user_agent",
-      "action",
-      "request_id",
-      "user",
       "business_id",
-      "_document_id",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1695,12 +2627,29 @@
     "description": "The trial of GitHub Enterprise Cloud expired.",
     "docs_reference_links": "/admin/overview/setting-up-a-trial-of-github-enterprise-cloud",
     "fields": [
-      "name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type"
     ],
@@ -1711,17 +2660,29 @@
     "description": "GitHub Models billing was disabled for the business.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1732,17 +2693,29 @@
     "description": "GitHub Models billing was enabled for the business.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1753,18 +2726,31 @@
     "description": "License usage information was imported from a GitHub Enterprise Server instance to an enterprise account on GitHub.com.",
     "docs_reference_links": "/billing/managing-your-license-for-github-enterprise/syncing-license-usage-between-github-enterprise-server-and-github-enterprise-cloud#manually-uploading-github-enterprise-server-license-usage",
     "fields": [
-      "name",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
       "business_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "business",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "actor_id"
+      "name",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Syncing license usage from GitHub Enterprise Server to Cloud"
   },
@@ -1773,19 +2759,30 @@
     "description": "An invitation for someone to be an enterprise owner of an enterprise was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "name",
-      "request_id",
+      "actor",
+      "actor_id",
       "business",
-      "invitation_id",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "actor",
-      "actor_id",
-      "_document_id",
-      "@timestamp",
-      "user",
+      "name",
+      "invitation_id",
       "operation_type",
       "created_at"
     ]
@@ -1795,20 +2792,31 @@
     "description": "An invitation for someone to be a billing manager of an enterprise was sent.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
-      "user_agent",
-      "invitation_id",
+      "@timestamp",
       "_document_id",
-      "business",
-      "actor",
-      "user_id",
       "action",
-      "@timestamp",
-      "name",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "invitation_id",
+      "name",
       "created_at"
     ]
   },
@@ -1817,19 +2825,31 @@
     "description": "An invitation for someone to join an enterprise was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "invitation_id",
       "email",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1840,20 +2860,31 @@
     "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
       "business",
-      "name",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "business_id",
-      "_document_id"
+      "created_at",
+      "name",
+      "operation_type"
     ]
   },
   {
@@ -1861,20 +2892,31 @@
     "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1882,20 +2924,31 @@
     "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "business",
-      "actor_id",
-      "created_at",
-      "action",
+      "user_id",
       "user_agent",
-      "request_id",
-      "user_id"
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1903,19 +2956,31 @@
     "description": "An enterprise has reached its members limit.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "limit",
       "count",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1926,19 +2991,31 @@
     "description": "An enterprise is approaching its organizations limit.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "limit",
       "count",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1949,16 +3026,28 @@
     "description": "The proxy security header was disabled for an enterprise. All users on the network can now access GitHub, unless blocked by other means.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1969,15 +3058,28 @@
     "description": "The proxy security header was enabled for an enterprise. When the header is provided in requests, only Enterprise Managed Users matching the header will be able to access GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1988,15 +3090,29 @@
     "description": "A user outside the enterprise tried to access GitHub while the proxy security header was enabled and provided in the request.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "programmatic_access_type",
-      "name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2007,17 +3123,30 @@
     "description": "An enterprise owner failed to sign into a enterprise with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/accessing-your-enterprise-account-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "reason",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2028,16 +3157,29 @@
     "description": "An enterprise owner successfully signed into an enterprise with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/accessing-your-enterprise-account-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type"
     ],
@@ -2048,19 +3190,31 @@
     "description": "An enterprise owner downloaded the enterprise's SSO recovery codes.",
     "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your enterprise account's single sign-on recovery codes"
   },
@@ -2069,39 +3223,64 @@
     "description": "An enterprise owner generated the enterprise's SSO recovery codes.",
     "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type"
-    ],
-    "docs_reference_titles": "Downloading your enterprise account's single sign-on recovery codes"
-  },
-  {
-    "action": "business.recovery_codes_printed",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "Downloading your enterprise account's single sign-on recovery codes"
+  },
+  {
+    "action": "business.recovery_codes_printed",
     "description": "An enterprise owner printed the enterprise's SSO recovery codes.",
     "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your enterprise account's single sign-on recovery codes"
   },
@@ -2110,16 +3289,29 @@
     "description": "An enterprise owner viewed the enterprise's SSO recovery codes.",
     "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type"
     ],
@@ -2130,20 +3322,31 @@
     "description": "An enterprise owner was removed from an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
-      "user_agent",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "name",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
-      "user"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ],
     "docs_reference_titles": "Inviting people to manage your enterprise"
   },
@@ -2152,19 +3355,30 @@
     "description": "A billing manager was removed from an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
       "business",
-      "actor",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "request_id",
-      "action",
-      "_document_id",
       "operation_type",
-      "@timestamp",
       "name",
-      "business_id",
-      "user",
       "created_at"
     ]
   },
@@ -2173,20 +3387,30 @@
     "description": "Removed a two-factor authentication method restriction for an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
-      "two_factor_method",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "two_factor_method",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2197,20 +3421,30 @@
     "description": "A member was removed from an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "business_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
-      "user",
-      "created_at",
+      "actor_id",
       "business",
-      "user_id",
-      "action",
-      "_document_id",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2218,20 +3452,31 @@
     "description": "An organization was removed from an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "business",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "business_id",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "name",
-      "org"
+      "name"
     ]
   },
   {
@@ -2239,20 +3484,31 @@
     "description": "A support entitlement was removed from a member of an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/managing-support-entitlements-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing support entitlements for your enterprise"
   },
@@ -2261,38 +3517,63 @@
     "description": "The slug for the enterprise URL was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "name",
-      "business_id",
-      "user_agent",
-      "action",
-      "actor_id",
-      "operation_type",
-      "actor",
       "@timestamp",
-      "created_at",
-      "business",
-      "_document_id"
-    ]
-  },
-  {
-    "action": "business.restore",
-    "description": "The deleted enterprise was restored.",
-    "docs_reference_links": "N/A",
-    "fields": [
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "request_access_security_header"
+      "created_at"
+    ]
+  },
+  {
+    "action": "business.restore",
+    "description": "The deleted enterprise was restored.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2300,20 +3581,31 @@
     "description": "The external identity for a member in an enterprise was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
+      "action",
       "actor",
-      "created_at",
-      "name",
-      "user_agent",
       "actor_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ]
   },
   {
@@ -2321,20 +3613,31 @@
     "description": "The SAML single sign-on session for a member in an enterprise was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "_document_id",
-      "actor_id",
       "name",
-      "@timestamp",
-      "user_id",
-      "action",
-      "created_at",
-      "business"
+      "created_at"
     ]
   },
   {
@@ -2342,15 +3645,28 @@
     "description": "Enablement for Secret Protection features on new repositories has been locked for this enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2361,15 +3677,28 @@
     "description": "Enablement for Secret Protection features on new repositories has been unlocked for this enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2380,17 +3709,28 @@
     "description": "Automatic partner validation checks have been disabled at the business level",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -2401,17 +3741,28 @@
     "description": "Automatic partner validation checks have been enabled at the business level",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -2422,20 +3773,30 @@
     "description": "An enterprise-level custom pattern was created for secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -2444,17 +3805,28 @@
     "description": "An enterprise-level custom pattern was removed from secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2464,20 +3836,30 @@
     "description": "An enterprise-level custom pattern was published for secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2485,17 +3867,28 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -2506,20 +3899,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -2528,17 +3931,28 @@
     "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2548,17 +3962,28 @@
     "description": "Secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -2569,17 +3994,28 @@
     "description": "Secret scanning was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -2590,17 +4026,28 @@
     "description": "Secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -2611,17 +4058,28 @@
     "description": "Secret scanning was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -2632,17 +4090,28 @@
     "description": "Generic secrets have been disabled at the business level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2653,21 +4122,31 @@
     "description": "Generic secrets have been enabled at the business level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -2675,17 +4154,28 @@
     "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2697,17 +4187,28 @@
     "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2719,17 +4220,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -2740,17 +4252,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -2761,17 +4284,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -2782,17 +4316,28 @@
     "description": "Push protection for secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -2803,17 +4348,28 @@
     "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -2824,17 +4380,28 @@
     "description": "Push protection for secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -2845,17 +4412,28 @@
     "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -2866,10 +4444,28 @@
     "description": "The push protection setting was updated for a secret type for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "push_protection_setting",
       "secret_type",
       "secret_type_display_name",
@@ -2882,10 +4478,28 @@
     "description": "The push protection pattern configuration was updated for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
@@ -2895,20 +4509,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2916,26 +4542,36 @@
     "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -2943,24 +4579,34 @@
     "description": "A CSV export was requested on the \"Coverage\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -2968,26 +4614,36 @@
     "description": "A CSV export was requested on the \"Overview Dashboard\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -2995,20 +4651,31 @@
     "description": "A CSV export was requested on the \"Risk\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3019,17 +4686,29 @@
     "description": "The cache retention policy for GitHub Actions was set for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3041,17 +4720,29 @@
     "description": "The cache storage policy for GitHub Actions was set for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3063,17 +4754,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -3084,20 +4788,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -3106,19 +4822,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -3127,19 +4856,31 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -3148,20 +4889,32 @@
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -3170,19 +4923,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -3191,20 +4956,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "issuer",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
       "business_id",
-      "actor_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "issuer",
+      "name",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3212,18 +4989,31 @@
     "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "updated_github_owned_allowed",
       "updated_verified_allowed",
       "updated_patterns",
@@ -3238,20 +5028,33 @@
     "description": "The base repository permission setting was updated for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
     "fields": [
-      "business_id",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "permission",
-      "action",
       "created_at",
-      "@timestamp",
-      "request_id",
       "name",
-      "_document_id",
-      "old_permission",
-      "business"
+      "old_permission"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3260,18 +5063,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "old_emu_repo_runners_policy",
       "new_emu_repo_runners_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3281,19 +5097,32 @@
     "description": "The repository creation setting was updated for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "name",
-      "business_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "operation_type",
-      "permission",
-      "action",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "name",
+      "operation_type",
+      "permission",
       "visibility"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -3303,19 +5132,32 @@
     "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories",
     "fields": [
-      "business_id",
-      "created_at",
-      "action",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "permission",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "business"
+      "created_at",
+      "operation_type",
+      "permission",
+      "name"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3324,18 +5166,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "old_repo_runners_policy",
       "new_repo_runners_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3345,41 +5200,64 @@
     "description": "The SAML single sign-on provider settings for an enterprise were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "business_id",
-      "sso_url",
-      "user_agent",
       "action",
-      "business",
-      "name",
-      "created_at",
-      "operation_type",
+      "actor",
       "actor_id",
-      "@timestamp",
-      "issuer"
-    ]
-  },
-  {
-    "action": "business.upgrade_from_organization",
-    "description": "The organization was upgraded to an enterprise account.",
-    "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/upgrading-your-accounts-plan#upgrading-your-organizations-plan",
-    "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "name",
       "created_at",
       "operation_type",
+      "issuer"
+    ]
+  },
+  {
+    "action": "business.upgrade_from_organization",
+    "description": "The organization was upgraded to an enterprise account.",
+    "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/upgrading-your-accounts-plan#upgrading-your-organizations-plan",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "request_access_security_header"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Upgrading your account's plan"
   },
@@ -3388,20 +5266,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -3410,20 +5299,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -3434,17 +5334,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3452,15 +5364,31 @@
     "description": "Existing code scanning alerts appeared in a branch.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -3470,15 +5398,31 @@
     "description": "Code scanning alerts were fixed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -3488,15 +5432,31 @@
     "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_numbers",
       "commit_oid",
-      "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business"
+      "ref"
     ],
     "docs_reference_titles": "About code scanning"
   },
@@ -3505,15 +5465,29 @@
     "description": "Code scanning alerts were manually dismissed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers",
       "dismissal_approver_id"
     ],
@@ -3524,19 +5498,31 @@
     "description": "Dismissal of code scanning alerts was approved.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "dismissal_request_id",
-      "alert_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismissal_request_id",
+      "alert_number",
+      "public_repo",
       "created_at",
       "operation_type"
     ],
@@ -3547,19 +5533,31 @@
     "description": "Dismissal of code scanning alerts was denied.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3570,19 +5568,31 @@
     "description": "Dismissal of code scanning alerts was requested.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3593,13 +5603,31 @@
     "description": "Code scanning alerts were seen for the first time.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -3609,15 +5637,31 @@
     "description": "Code scanning alerts that were previously fixed reappeared.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -3627,15 +5671,29 @@
     "description": "Code scanning alerts that were previously dismissed were reopened.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -3645,14 +5703,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3662,28 +5735,34 @@
     "description": "An attempt to create a codespace from a prebuild was made.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "owner",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "user_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
       "created_at",
       "operation_type",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -3691,17 +5770,30 @@
     "description": "Enterprise setting for Codespaces ownership was updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enablement",
       "organization_names",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3712,25 +5804,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -3741,22 +5842,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -3768,22 +5880,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -3792,15 +5915,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -3811,15 +5949,28 @@
     "description": "Policies were applied to codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3829,20 +5980,30 @@
     "description": "Policies were removed from codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3850,19 +6011,30 @@
     "description": "Policies were updated for codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -3870,17 +6042,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3890,27 +6075,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "org",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3918,19 +6112,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -3938,40 +6145,62 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "Managing access to other repositories within your codespace"
-  },
-  {
-    "action": "commit_comment.destroy",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Managing access to other repositories within your codespace"
+  },
+  {
+    "action": "commit_comment.destroy",
     "description": "A commit comment was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "created_at",
-      "@timestamp",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "programmatic_access_type"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3979,21 +6208,30 @@
     "description": "A commit comment was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_id",
-      "action",
-      "@timestamp",
-      "repo",
       "org_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4001,21 +6239,33 @@
     "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "reason",
       "plan",
-      "org_id",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4023,17 +6273,30 @@
     "description": "The Copilot enablement policy changed at the enterprise level to either allow or disable access for all organizations, or to allow access for selected organizations.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "previous_value",
       "current_value",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4044,15 +6307,28 @@
     "description": "Copilot feature settings were changed at the enterprise level.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4062,13 +6338,28 @@
     "description": "Copilot feature settings were changed at the organization level.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4078,23 +6369,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4102,16 +6400,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -4120,24 +6432,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4145,15 +6463,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4163,20 +6494,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4184,19 +6525,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -4204,21 +6557,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -4226,21 +6588,33 @@
     "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_value",
       "new_value",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4248,15 +6622,28 @@
     "description": "The GitHub Copilot Product Terms or Pre-Release Preview Terms were accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4266,21 +6653,32 @@
     "description": "The excluded paths for GitHub Copilot were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "excluded_paths",
       "owner_type",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -4288,17 +6686,30 @@
     "description": "Copilot access was enabled or disabled at the enterprise level.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "previous_value",
       "current_value",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4308,17 +6719,30 @@
     "description": "The plan for GitHub Copilot was updated.",
     "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_plan",
       "plan",
-      "business_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4330,20 +6754,31 @@
     "description": "The plan for GitHub Copilot was scheduled to be downgraded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "current_plan",
       "scheduled_plan"
@@ -4354,21 +6789,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -4378,19 +6822,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4400,21 +6853,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -4424,18 +6886,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -4448,18 +6923,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -4473,14 +6961,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -4493,8 +6996,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -4503,27 +7005,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -4532,19 +7042,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -4553,16 +7075,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "definition_id"
@@ -4574,40 +7109,62 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
   {
     "action": "dependabot_alerts.enable",
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -4616,19 +7173,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -4637,19 +7205,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -4658,25 +7237,33 @@
     "description": "Dismissal of Dependabot alerts was approved.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -4686,25 +7273,33 @@
     "description": "Dismissal request for Dependabot alerts was canceled.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -4714,25 +7309,33 @@
     "description": "Dismissal of Dependabot alerts was requested.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -4742,25 +7345,33 @@
     "description": "Dismissal of Dependabot alerts was denied.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -4770,21 +7381,31 @@
     "description": "The default repository access for Dependabot was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "access_level",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -4793,17 +7414,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4811,19 +7445,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -4832,19 +7477,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4852,19 +7508,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -4873,19 +7540,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -4893,19 +7571,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -4914,19 +7603,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4934,19 +7634,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -4955,20 +7666,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4976,21 +7697,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "repo_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "org_id",
-      "_document_id",
       "actor_id",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4998,20 +7728,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "request_id",
-      "org",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5019,22 +7759,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "actor_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "title",
-      "_document_id",
-      "created_at",
-      "repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5042,17 +7791,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -5063,16 +7826,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -5083,18 +7860,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
       "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -5105,23 +7896,31 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise"
   },
@@ -5130,19 +7929,33 @@
     "description": "A domain was approved for an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -5151,18 +7964,33 @@
     "description": "A domain was added to an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -5171,18 +7999,33 @@
     "description": "A domain was removed from an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -5191,18 +8034,33 @@
     "description": "A domain was verified for an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -5211,17 +8069,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was created.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "org_id",
       "action",
-      "request_id",
-      "org",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -5230,17 +8101,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "actor_id",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -5249,18 +8133,30 @@
     "description": "A new GitHub Actions self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -5269,20 +8165,30 @@
     "description": "A GitHub Actions self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -5291,20 +8197,30 @@
     "description": "An enterprise role was assigned to a user or enterprise team.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "enterprise_role_id",
-      "enterprise_role_name",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "enterprise_role_id",
+      "enterprise_role_name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5316,20 +8232,32 @@
     "description": "A custom enterprise role was created in an enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5341,20 +8269,32 @@
     "description": "A custom enterprise role was deleted in an enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5366,20 +8306,30 @@
     "description": "A user or enterprise team was unassigned an enterprise role.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "request_access_security_header",
       "enterprise_role_id",
       "enterprise_role_name",
-      "business",
-      "business_id",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5391,21 +8341,33 @@
     "description": "A custom enterprise role was edited in an enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
       "old_role_permissions",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5417,18 +8379,31 @@
     "description": "A GitHub Actions self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
@@ -5438,18 +8413,31 @@
     "description": "A GitHub Actions self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -5458,18 +8446,31 @@
     "description": "A GitHub Actions self-hosted runner group was renamed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -5478,20 +8479,33 @@
     "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -5500,19 +8514,31 @@
     "description": "A GitHub Actions self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -5521,19 +8547,32 @@
     "description": "A GitHub Actions runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -5542,24 +8581,36 @@
     "description": "The configuration of a GitHub Actions self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -5568,19 +8619,32 @@
     "description": "The visibility of a GitHub Actions self-hosted runner group was updated via the REST API.",
     "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
-      "visibility",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
   },
@@ -5589,14 +8653,32 @@
     "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -5605,14 +8687,32 @@
     "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -5621,18 +8721,36 @@
     "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
       "target_version",
       "runner_group_id",
       "runner_group_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Self-hosted runners"
   },
@@ -5641,22 +8759,32 @@
     "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "business_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "user",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5664,21 +8792,33 @@
     "description": "A license for GitHub Copilot was assigned to an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5686,17 +8826,30 @@
     "description": "A license for GitHub Copilot was unassigned from an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5707,17 +8860,30 @@
     "description": "A new enterprise team was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5727,17 +8893,30 @@
     "description": "An enterprise team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5748,22 +8927,32 @@
     "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "business_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "user",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5771,18 +8960,31 @@
     "description": "The name of an enterprise team was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "business_id",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5793,22 +8995,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -5817,22 +9028,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5840,28 +9061,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -5870,27 +9097,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5899,25 +9134,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -5926,26 +9169,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -5954,21 +9204,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5977,22 +9239,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -6001,25 +9273,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -6028,22 +9309,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -6052,21 +9345,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -6077,27 +9380,33 @@
     "description": "A user was added to an external group.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "external_group",
-      "external_group_id",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "external_group",
+      "external_group_id",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -6105,19 +9414,31 @@
     "description": "An external group was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at",
       "scim_group_id"
     ]
   },
@@ -6126,22 +9447,33 @@
     "description": "An external group was linked to a GitHub team.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "external_group",
-      "programmatic_access_type",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -6149,21 +9481,31 @@
     "description": "An external group was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6171,26 +9513,32 @@
     "description": "A user was removed from an external group.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "external_group",
-      "external_group_id",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "external_group",
+      "external_group_id",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6198,15 +9546,29 @@
     "description": "Failed external group SCIM API request.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
@@ -6214,15 +9576,9 @@
       "url_path",
       "scim_group_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -6231,30 +9587,38 @@
     "description": "Successful external group SCIM API request. Excludes GET API requests.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -6263,18 +9627,31 @@
     "description": "An external group was unlinked to a GitHub team.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "external_group"
     ]
   },
@@ -6283,22 +9660,32 @@
     "description": "An external group was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "scim_group_id",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at",
+      "scim_group_id"
     ]
   },
   {
@@ -6306,25 +9693,33 @@
     "description": "An external group's display name was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
       "external_group",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -6332,20 +9727,31 @@
     "description": "An external identity was deprovisioned, suspending the linked GitHub user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6353,17 +9759,31 @@
     "description": "An external identity was created and linked to a GitHub user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "scim_user_id",
-      "request_access_security_header"
+      "scim_user_id"
     ]
   },
   {
@@ -6371,15 +9791,29 @@
     "description": "Failed external identity SCIM API request.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
@@ -6387,15 +9821,9 @@
       "url_path",
       "scim_user_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -6404,30 +9832,38 @@
     "description": "Successful external identity SCIM API request. Excludes GET API requests.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -6436,18 +9872,31 @@
     "description": "An external identity was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "scim_user_id",
-      "request_access_security_header"
+      "scim_user_id"
     ]
   },
   {
@@ -6455,19 +9904,30 @@
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -6476,20 +9936,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -6498,19 +9968,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -6519,23 +10000,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6543,18 +10033,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -6565,20 +10065,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -6588,25 +10098,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -6614,25 +10134,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -6640,26 +10169,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -6668,25 +10206,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -6694,26 +10241,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -6721,21 +10277,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -6744,19 +10311,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -6764,21 +10344,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -6787,19 +10378,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -6810,20 +10415,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -6833,24 +10450,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -6861,23 +10489,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -6888,21 +10528,33 @@
     "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
       "operation_type",
-      "@timestamp",
       "integration",
-      "action",
-      "user_agent",
       "reason",
-      "_document_id",
-      "org",
-      "org_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -6913,20 +10565,32 @@
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
       "@timestamp",
-      "actor_id",
-      "org",
       "_document_id",
-      "requester",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "requester",
       "created_at",
       "url",
-      "org_id",
-      "request_id",
       "operation_type",
-      "actor",
       "integration",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -6936,20 +10600,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -6959,19 +10636,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -6980,20 +10671,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -7003,20 +10707,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -7025,20 +10742,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -7047,20 +10777,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7068,19 +10810,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -7089,19 +10844,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -7110,17 +10878,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -7133,21 +10914,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -7161,17 +10955,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -7183,19 +10990,30 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "user"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7203,19 +11021,30 @@
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7223,15 +11052,28 @@
     "description": "Identity Provider based IP allow list for web interactions was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -7242,15 +11084,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7260,17 +11115,28 @@
     "description": "IP allow list user level enforcement was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7280,20 +11146,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "user_id",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
-      "_document_id",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "actor_id",
       "operation_type",
-      "org",
       "created_at"
     ]
   },
@@ -7302,19 +11177,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7322,15 +11208,28 @@
     "description": "Identity Provider based IP allow list for web interactions was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -7341,15 +11240,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7359,17 +11271,28 @@
     "description": "IP allow list user level enforcement was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7379,24 +11302,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7404,24 +11335,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "ip_allow_list_entry",
-      "org",
-      "operation_type",
-      "created_at",
-      "active",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at",
+      "active"
     ]
   },
   {
@@ -7429,19 +11368,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "actor_id",
       "ip_allow_list_entry",
-      "active",
-      "org_id",
-      "@timestamp"
+      "active"
     ]
   },
   {
@@ -7449,15 +11401,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7467,47 +11432,62 @@
     "description": "A comment on an issue was deleted from the repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "org",
-      "repo",
-      "actor_id",
       "@timestamp",
-      "created_at",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "oauth_application_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
     "action": "issue_comment.pinned",
     "description": "A comment on an issue was pinned to a repository.",
     "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "hashed_token",
-      "programmatic_access_type",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -7518,19 +11498,29 @@
     "description": "A comment on an issue was unpinned from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -7541,22 +11531,31 @@
     "description": "A comment on an issue (other than the initial one) changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "action",
-      "repo_id",
-      "org_id",
-      "created_at",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "request_id",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
-      "oauth_application_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -7564,21 +11563,31 @@
     "description": "An issue was deleted from the repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue",
     "fields": [
-      "user",
-      "actor_id",
-      "created_at",
-      "title",
       "@timestamp",
       "_document_id",
-      "request_id",
-      "actor",
-      "user_id",
       "action",
-      "operation_type",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type"
     ],
     "docs_reference_titles": "Deleting an issue"
   },
@@ -7587,23 +11596,33 @@
     "description": "An issue was pinned to a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
       "action",
       "actor",
-      "operation_type",
-      "owner_type",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "number",
-      "repo",
-      "event",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "owner_type",
+      "number",
+      "event"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -7612,22 +11631,32 @@
     "description": "An issue was transferred to another repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "owner_type",
-      "actor_id",
       "number",
-      "repo",
       "operation_type",
-      "_document_id",
-      "repo_id",
-      "action",
-      "request_id",
-      "created_at",
-      "actor",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Transferring an issue to another repository"
   },
@@ -7636,24 +11665,33 @@
     "description": "An issue was unpinned from a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
-      "event",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
-      "action",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "operation_type",
-      "_document_id",
-      "number",
-      "owner_type",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "token_scopes",
-      "request_access_security_header"
+      "user_agent",
+      "event",
+      "created_at",
+      "operation_type",
+      "number",
+      "owner_type"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -7662,19 +11700,30 @@
     "description": "The ability for enterprise members to delete issues was disabled  Members cannot delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
-      "operation_type",
-      "request_id",
-      "actor_id",
-      "user_id",
-      "created_at",
       "_document_id",
+      "action",
       "actor",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "org_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -7683,18 +11732,29 @@
     "description": "The ability for enterprise members to delete issues was enabled  Members can delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -7704,19 +11764,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user",
-      "request_id",
-      "actor",
-      "business_id",
-      "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -7725,18 +11796,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7744,21 +11827,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -7766,21 +11862,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7788,22 +11897,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -7811,19 +11933,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -7833,22 +11968,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -7856,22 +12004,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7879,20 +12040,30 @@
     "description": "The ability for members to publish GitHub Pages sites was disabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -7900,21 +12071,31 @@
     "action": "members_can_create_pages.enable",
     "description": "The ability for members to publish GitHub Pages sites was enabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
-    "fields": [
-      "user_agent",
-      "request_id",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -7923,21 +12104,30 @@
     "description": "The ability for members to publish public GitHub Pages was disabled  Members cannot publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -7946,22 +12136,30 @@
     "description": "The ability for members to publish public GitHub Pages was enabled  Members can publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -7970,19 +12168,30 @@
     "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "operation_type",
       "user_agent",
-      "actor",
-      "actor_id",
-      "business_id",
-      "@timestamp",
-      "created_at",
-      "action"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -7991,18 +12200,29 @@
     "description": "The ability for enterprise members to delete repositories was disabled  Members cannot delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "request_id",
-      "org",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "actor",
       "operation_type",
-      "org_id",
-      "action",
-      "@timestamp",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -8012,21 +12232,30 @@
     "description": "The ability for enterprise members to delete repositories was enabled  Members can delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "action",
-      "org_id",
-      "user_id",
-      "business",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
-      "org",
-      "operation_type",
-      "user_agent"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -8037,16 +12266,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -8055,21 +12295,30 @@
     "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "created_at",
-      "user_id",
       "business_id",
-      "user",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "org_id",
-      "@timestamp"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -8078,19 +12327,30 @@
     "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "user_id",
-      "business",
-      "business_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "actor_id"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -8099,19 +12359,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8119,21 +12391,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8143,16 +12424,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8162,18 +12456,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8183,14 +12490,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8198,19 +12521,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -8218,18 +12552,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8237,23 +12583,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -8261,16 +12615,30 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "org_id",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8278,24 +12646,32 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
-      "repo_id",
       "operation_type",
-      "@timestamp",
-      "user_agent",
       "created_at",
-      "org",
-      "action",
-      "_document_id",
-      "repo",
-      "actor",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8303,15 +12679,28 @@
     "description": "A network configuration for a hosted compute service was created.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -8329,15 +12718,28 @@
     "description": "A network configuration for a hosted compute service was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -8350,15 +12752,28 @@
     "description": "A network configuration for a hosted compute service was updated.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -8375,20 +12790,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -8397,20 +12824,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -8419,20 +12858,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -8441,20 +12892,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -8463,19 +12926,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -8484,20 +12960,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -8506,20 +12994,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -8528,19 +13028,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -8549,17 +13062,28 @@
     "description": "An invitation sent to an organization to join an enterprise was accepted.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -8570,20 +13094,30 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
   },
@@ -8592,21 +13126,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -8615,24 +13159,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8640,21 +13194,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -8662,20 +13226,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -8683,22 +13257,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -8706,20 +13288,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8727,22 +13319,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -8750,21 +13350,31 @@
     "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "new_policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -8774,19 +13384,30 @@
     "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -8795,19 +13416,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -8817,17 +13449,30 @@
     "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
   },
@@ -8836,21 +13481,32 @@
     "description": "An export of the organization's Git events was created.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "start",
       "end",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization"
   },
@@ -8859,16 +13515,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -8877,18 +13546,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
-      "actor",
-      "user_agent",
-      "org_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "blocked_user",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -8897,19 +13579,30 @@
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -8919,22 +13612,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "email",
-      "@timestamp",
-      "actor",
-      "action",
       "operation_type",
-      "user_agent",
-      "org",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -8942,19 +13646,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -8962,23 +13677,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8986,21 +13709,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9008,23 +13741,31 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9032,23 +13773,31 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9056,21 +13805,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -9079,21 +13837,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -9102,20 +13869,31 @@
     "description": "Access to use Codespaces on internal and private repositories was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "enablement",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "enablement",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization"
   },
@@ -9124,21 +13902,31 @@
     "description": "Ownership and payment for codespaces was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "owner_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
   },
@@ -9147,16 +13935,29 @@
     "description": "A team has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9166,16 +13967,29 @@
     "description": "A team has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9185,19 +13999,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -9206,17 +14031,30 @@
     "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -9225,21 +14063,30 @@
     "description": "A user has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -9247,21 +14094,30 @@
     "description": "A user has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -9269,16 +14125,29 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
@@ -9288,17 +14157,30 @@
     "description": "The interaction limit for prior contributors only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -9307,17 +14189,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -9327,16 +14222,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -9345,17 +14253,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "org",
-      "created_at",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -9364,17 +14285,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -9383,22 +14317,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -9407,17 +14349,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -9428,18 +14381,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
-      "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -9448,20 +14413,31 @@
     "description": "A GitHub Actions secret was created for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -9470,20 +14446,32 @@
     "description": "A GitHub Actions variable was created for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -9492,21 +14480,33 @@
     "description": "A Codespaces or Dependabot secret was created for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -9514,21 +14514,30 @@
     "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "org_id",
-      "business",
-      "action",
       "@timestamp",
-      "org",
       "_document_id",
-      "business_id",
+      "action",
       "actor",
-      "token_scopes",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "actor_is_bot",
       "oauth_credential_type",
       "managed_oauth_access_id",
@@ -9544,24 +14553,32 @@
     "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
-      "created_at",
-      "org_id",
-      "business_id",
-      "operation_type",
-      "request_id",
       "_document_id",
       "action",
+      "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "token_scopes",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot",
       "oauth_credential_type",
-      "request_access_security_header",
       "managed_oauth_access_id",
       "managed_token_id",
       "managed_oauth_scopes",
@@ -9575,21 +14592,32 @@
     "description": "An owner revoked authorized credentials.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "oauth_application_id",
-      "org_id",
       "operation_type",
-      "action",
-      "business",
-      "request_id",
       "created_at",
-      "business_id",
-      "actor_id",
-      "_document_id",
-      "user_agent",
       "oauth_credential_type",
       "managed_oauth_access_id",
       "managed_token_id",
@@ -9604,18 +14632,30 @@
     "description": "An organization was deleted by a user or staff.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "org_id",
-      "org",
       "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9623,20 +14663,30 @@
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -9645,16 +14695,29 @@
     "description": "Third-party application access restrictions for an organization were disabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization"
@@ -9664,19 +14727,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -9685,14 +14759,31 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sso_url",
       "issuer",
-      "action",
-      "@timestamp",
-      "_document_id",
       "created_at",
-      "org",
       "operation_type"
     ]
   },
@@ -9701,17 +14792,30 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9719,19 +14823,30 @@
     "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9739,19 +14854,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
-      "action",
-      "actor_id",
-      "org_id"
+      "created_at"
     ]
   },
   {
@@ -9759,19 +14885,30 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -9780,17 +14917,30 @@
     "description": "Third-party application access restrictions for an organization were enabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "operation_type",
-      "org",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization"
   },
@@ -9799,19 +14949,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -9820,19 +14981,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "sso_url",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "issuer",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "sso_url",
+      "created_at",
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -9841,17 +15015,30 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
   },
@@ -9860,17 +15047,30 @@
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -9879,18 +15079,31 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
-      "org",
-      "user_agent",
-      "request_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "manager",
       "operation_type",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -9898,23 +15111,32 @@
     "description": "A new user was invited to join an organization.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
     "fields": [
-      "org",
-      "user_id",
-      "invitation_id",
-      "org_id",
-      "user",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -9923,17 +15145,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9943,19 +15176,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -9963,19 +15207,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "@timestamp",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9983,19 +15238,31 @@
     "description": "Access to an organization was granted for an OAuth App.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "operation_type",
-      "org_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization"
@@ -10005,20 +15272,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -10027,18 +15305,31 @@
     "description": "Access was disabled for an OAuth App that was previously approved.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization",
     "fields": [
-      "request_id",
-      "url",
-      "created_at",
-      "org_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
@@ -10048,19 +15339,31 @@
     "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "url",
-      "org_id",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "url",
       "oauth_application_name"
     ]
   },
@@ -10069,20 +15372,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -10092,16 +15406,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -10109,20 +15436,31 @@
     "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "reason",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "reason",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -10131,20 +15469,30 @@
     "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -10153,19 +15501,30 @@
     "description": "An organization owner downloaded the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -10174,19 +15533,30 @@
     "description": "An organization owner generated the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -10195,19 +15565,30 @@
     "description": "An organization owner printed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -10216,19 +15597,30 @@
     "description": "An organization owner viewed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -10237,19 +15629,31 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -10258,20 +15662,31 @@
     "description": "A GitHub Actions secret was removed from an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -10280,21 +15695,31 @@
     "description": "A GitHub Actions variable was removed from an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -10303,18 +15728,29 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
@@ -10324,22 +15760,32 @@
     "description": "A Codespaces or Dependabot secret was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -10347,21 +15793,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -10369,21 +15824,30 @@
     "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user",
-      "org_id",
-      "created_at",
-      "request_id",
       "@timestamp",
-      "action",
-      "operation_type",
-      "user_agent",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -10391,21 +15855,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -10413,18 +15887,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -10433,19 +15919,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
-      "old_login",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_login",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -10453,14 +15951,28 @@
     "description": "Triggered when a required workflow is created.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -10471,14 +15983,28 @@
     "description": "Triggered when a required workflow is deleted.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -10489,14 +16015,28 @@
     "description": "Triggered when a required workflow is updated.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -10507,20 +16047,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -10529,21 +16079,33 @@
     "description": "A self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -10553,21 +16115,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "programmatic_access_type"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -10576,20 +16148,31 @@
     "description": "A self-hosted runner group was renamed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -10598,23 +16181,33 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -10623,23 +16216,31 @@
     "description": "A self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -10648,19 +16249,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -10669,25 +16283,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -10696,21 +16321,32 @@
     "description": "The visibility of a self-hosted runner group was updated via the REST API.",
     "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
   },
@@ -10719,21 +16355,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -10743,21 +16388,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -10767,20 +16421,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -10789,22 +16453,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -10813,21 +16485,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -10836,21 +16517,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -10859,22 +16549,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -10883,21 +16581,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -10906,22 +16613,30 @@
     "description": "Generic secrets have been disabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10929,22 +16644,30 @@
     "description": "Generic secrets have been enabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10952,21 +16675,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -10976,21 +16708,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -11000,19 +16741,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -11022,21 +16774,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -11046,21 +16807,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -11070,19 +16840,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -11092,22 +16873,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -11116,22 +16905,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -11140,22 +16937,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -11164,21 +16969,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -11187,21 +17001,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -11210,22 +17033,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -11234,22 +17065,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -11258,12 +17097,28 @@
     "description": "The push protection setting was updated for a secret type for your organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "push_protection_setting",
       "secret_type",
       "secret_type_display_name",
@@ -11276,12 +17131,28 @@
     "description": "The push protection pattern configuration was updated for your organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at"
     ],
     "docs_reference_titles": "About push protection"
@@ -11291,15 +17162,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -11308,15 +17196,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -11325,7 +17230,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -11340,18 +17266,28 @@
     "description": "The cache retention policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -11363,18 +17299,28 @@
     "description": "The cache storage policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -11386,20 +17332,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -11408,16 +17365,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -11428,18 +17398,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -11448,17 +17431,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11466,18 +17462,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -11486,18 +17494,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -11506,18 +17527,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -11526,22 +17559,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issuer",
-      "business",
       "operation_type",
       "created_at",
-      "request_id",
-      "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11549,21 +17592,32 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
   },
@@ -11572,19 +17626,30 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11595,19 +17660,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
-      "oauth_application_id",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "blocked_user",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -11616,20 +17694,32 @@
     "description": "A GitHub Actions secret was updated for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "created_at",
       "key",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -11638,23 +17728,34 @@
     "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -11663,20 +17764,32 @@
     "description": "A GitHub Actions variable was updated for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -11685,20 +17798,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -11706,18 +17831,30 @@
     "description": "The settings policy for immutable releases was updated for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_policy",
       "new_policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -11728,22 +17865,33 @@
     "description": "A Codespaces or Dependabot secret was updated for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -11752,20 +17900,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -11773,17 +17932,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -11793,20 +17965,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -11815,17 +17998,30 @@
     "description": "The name of the default branch was changed for new repositories in the organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
   },
@@ -11834,19 +18030,32 @@
     "description": "An organization's SAML provider settings were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
-      "@timestamp",
-      "issuer",
-      "org",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -11854,18 +18063,30 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "org",
-      "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
@@ -11874,11 +18095,28 @@
     "description": "A new organization custom property definition was created.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "description",
@@ -11886,11 +18124,6 @@
       "required",
       "allowed_values",
       "default_value",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -11902,11 +18135,28 @@
     "description": "An organization custom property definition was deleted.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "description",
@@ -11914,11 +18164,6 @@
       "required",
       "allowed_values",
       "default_value",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -11930,20 +18175,32 @@
     "description": "An organization custom property definition was updated.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "old_values_editable_by",
       "values_editable_by",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -11958,21 +18215,31 @@
     "description": "An organization's custom property value was manually set for the first time.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -11984,21 +18251,31 @@
     "description": "An organization's custom property value was deleted.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12010,18 +18287,30 @@
     "description": "A default label was created for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
-      "_document_id",
-      "action",
-      "created_at",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label"
   },
@@ -12030,17 +18319,30 @@
     "description": "A default label was deleted for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label"
   },
@@ -12049,17 +18351,30 @@
     "description": "A default label was edited for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label",
     "fields": [
-      "org",
-      "created_at",
       "@timestamp",
-      "actor",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label"
   },
@@ -12068,20 +18383,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "org_id",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -12090,16 +18418,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -12108,14 +18451,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -12126,16 +18484,31 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "operation_type",
-      "domain_name",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
       "_document_id",
-      "actor_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "domain_name",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -12144,16 +18517,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -12163,17 +18549,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -12183,16 +18580,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -12202,20 +18612,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -12223,19 +18643,30 @@
     "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor",
-      "business_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
       "user_agent",
-      "_document_id",
       "created_at",
-      "operation_type",
-      "request_id",
-      "business"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -12244,19 +18675,30 @@
     "description": "Organization projects were disabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -12265,18 +18707,29 @@
     "description": "Organization projects were enabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor_id",
-      "org_id",
-      "created_at",
-      "user_id",
-      "org",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
@@ -12286,23 +18739,33 @@
     "description": "An organization role was assigned to a user or team.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About custom organization roles"
   },
@@ -12311,25 +18774,32 @@
     "description": "A custom organization role was created in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12341,25 +18811,32 @@
     "description": "A custom organization role was deleted in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -12370,19 +18847,30 @@
     "description": "A user or team was unassigned an organization role.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type"
     ],
@@ -12393,26 +18881,33 @@
     "description": "A custom organization role was edited in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
       "old_role_permissions",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -12425,22 +18920,33 @@
     "description": "An organization's default project base role was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_project_base_role",
-      "new_project_base_role",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_project_base_role",
+      "new_project_base_role",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -12448,20 +18954,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -12471,23 +18988,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -12496,21 +19024,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -12521,21 +19060,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -12544,20 +19096,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -12566,17 +19132,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -12587,20 +19168,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -12609,18 +19204,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12628,16 +19235,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12645,18 +19266,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12664,18 +19297,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -12686,22 +19332,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -12709,22 +19364,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -12732,18 +19396,28 @@
     "description": "The configured restriction for access to resources via personal access tokens was reset and delegated to organizations.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12754,18 +19428,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -12776,18 +19463,28 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12798,18 +19495,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12820,18 +19527,28 @@
     "description": "Triggered when the enterprise delegates to the organizations when to require approval for fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12842,23 +19559,34 @@
     "description": "A personal access token expiration limit was set.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "token_expiration",
       "old_token_expiration",
       "exempt_administrators",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -12866,21 +19594,32 @@
     "description": "A personal access token expiration limit was unset.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "programmatic_access_type",
-      "old_token_expiration",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_token_expiration",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -12888,17 +19627,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -12909,18 +19661,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
+      "repository_selection",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -12932,17 +19697,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -12954,20 +19732,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -12979,20 +19766,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -13004,20 +19800,29 @@
     "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -13029,20 +19834,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -13054,15 +19868,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -13072,17 +19901,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -13092,15 +19932,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -13110,19 +19965,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "business_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13130,23 +19996,30 @@
     "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "created_at",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
-      "repo",
       "action",
-      "user_agent",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "request_id",
-      "user_id",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13154,23 +20027,30 @@
     "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "repo",
-      "org",
-      "business",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org_id",
-      "created_at",
-      "business_id"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13178,17 +20058,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -13198,17 +20089,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -13218,17 +20120,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -13238,17 +20151,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -13258,17 +20182,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -13278,17 +20215,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13296,25 +20246,36 @@
     "description": "A project's base role was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_project_base_role",
       "new_project_base_role",
       "project_number",
       "public_project",
-      "business",
       "project_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13322,20 +20283,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -13345,25 +20317,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "collaborator_type",
-      "org",
-      "org_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -13371,20 +20355,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -13392,25 +20388,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -13418,17 +20426,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13436,17 +20457,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13454,18 +20488,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -13474,18 +20520,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -13494,19 +20552,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -13514,17 +20583,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -13536,22 +20618,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -13559,19 +20650,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13579,17 +20681,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13597,18 +20712,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -13616,20 +20744,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13637,18 +20775,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -13657,18 +20807,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -13677,16 +20839,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -13698,21 +20873,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -13720,22 +20907,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -13744,29 +20941,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -13774,24 +20976,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "repo_id",
-      "user_id",
       "@timestamp",
-      "user_agent",
-      "repo",
-      "name",
-      "org_id",
-      "user",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -13802,21 +21012,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -13827,22 +21047,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -13850,24 +21080,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "authorized_actors_only",
       "authorized_actors",
       "created_at",
-      "user_agent",
       "name",
-      "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
-      "actor_id",
-      "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -13875,30 +21115,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -13908,28 +21155,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -13940,23 +21195,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -13964,23 +21228,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "actor_id",
-      "name",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo",
-      "operation_type",
-      "request_id",
-      "allow_force_pushes_enforcement_level",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_force_pushes_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -13988,24 +21261,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -14014,24 +21296,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "lock_allows_fetch_and_merge",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -14040,27 +21331,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -14069,18 +21367,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -14091,24 +21402,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -14116,25 +21436,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14142,22 +21469,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -14165,46 +21502,67 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
+  },
+  {
+    "action": "protected_branch.update_required_approving_review_count",
+    "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
-  },
-  {
-    "action": "protected_branch.update_required_approving_review_count",
-    "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "required_approving_review_count",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -14212,25 +21570,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
     ]
   },
   {
@@ -14238,22 +21603,32 @@
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
       "action",
       "actor",
       "actor_id",
-      "signature_requirement_enforcement_level",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "programmatic_access_type"
+      "operation_type",
+      "name",
+      "created_at",
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -14261,22 +21636,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "created_at",
-      "repo_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "name",
-      "actor",
-      "repo",
       "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
+      "strict_required_status_checks_policy"
     ]
   },
   {
@@ -14284,23 +21669,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -14309,24 +21705,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -14335,20 +21742,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -14357,21 +21778,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -14381,22 +21815,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -14405,25 +21851,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -14432,23 +21888,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -14457,18 +21924,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -14478,21 +21959,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -14501,19 +21993,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -14524,23 +22029,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -14550,17 +22067,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14568,19 +22099,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -14588,19 +22132,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -14610,21 +22167,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -14633,27 +22201,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "pull_request_url",
       "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -14661,23 +22236,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -14686,18 +22273,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -14705,19 +22306,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -14727,20 +22340,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
-      "repo",
-      "created_at",
-      "request_id",
-      "comment_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "comment_id",
+      "operation_type"
     ]
   },
   {
@@ -14748,18 +22372,31 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "_document_id",
-      "@timestamp",
-      "comment_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "comment_id"
     ]
   },
   {
@@ -14767,21 +22404,33 @@
     "description": "A review on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -14789,20 +22438,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -14811,19 +22473,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -14833,22 +22509,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -14857,21 +22543,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -14880,25 +22575,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -14907,23 +22609,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -14932,24 +22642,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -14958,23 +22675,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -14984,22 +22709,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -15008,19 +22742,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -15029,24 +22776,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -15055,24 +22812,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15080,24 +22845,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15105,24 +22878,32 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15130,24 +22911,32 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15155,23 +22944,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -15182,17 +22980,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15202,17 +23012,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15222,25 +23044,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -15249,26 +23077,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -15277,25 +23113,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "query_suite",
       "threat_model",
       "languages",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -15305,19 +23150,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to this repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -15326,19 +23182,30 @@
     "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15346,17 +23213,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -15365,15 +23245,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -15384,16 +23277,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -15403,17 +23309,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -15423,19 +23342,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -15444,17 +23374,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -15463,26 +23406,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -15491,30 +23440,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -15524,20 +23478,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -15546,25 +23511,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -15573,23 +23546,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -15597,25 +23581,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -15625,23 +23618,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -15651,24 +23653,32 @@
     "description": "The setting for immutable releases was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15677,20 +23687,30 @@
     "description": "The setting for immutable releases was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -15701,23 +23721,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -15725,21 +23755,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -15747,21 +23787,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -15769,22 +23819,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -15792,21 +23851,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -15814,20 +23883,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15835,22 +23915,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15858,18 +23947,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15877,22 +23980,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15900,21 +24013,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -15922,18 +24045,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -15942,22 +24077,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -15966,24 +24110,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -15992,23 +24144,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -16016,26 +24178,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -16044,21 +24211,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -16067,25 +24243,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "repo_id",
-      "user_agent",
-      "topic",
-      "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
-      "programmatic_access_type"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "topic",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16093,22 +24275,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -16117,25 +24309,34 @@
     "description": "A branch was renamed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "old_branch",
-      "new_branch",
-      "default_branch",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "old_branch",
+      "new_branch",
+      "default_branch",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch"
@@ -16145,19 +24346,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16165,17 +24377,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -16184,17 +24411,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -16203,7 +24445,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -16218,22 +24481,30 @@
     "description": "The cache retention policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -16245,22 +24516,30 @@
     "description": "The cache storage policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -16272,23 +24551,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -16298,20 +24586,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -16322,21 +24621,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -16345,22 +24655,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -16369,21 +24689,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -16392,22 +24723,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -16418,16 +24759,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -16436,22 +24788,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -16461,22 +24822,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -16485,23 +24857,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -16511,19 +24893,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at",
-      "actor",
-      "visibility",
-      "repo_id",
-      "actor_id",
-      "repo",
-      "request_access_security_header"
+      "visibility"
     ]
   },
   {
@@ -16531,21 +24923,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -16554,24 +24956,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -16579,25 +24990,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -16606,24 +25024,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -16632,25 +25060,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -16659,22 +25095,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -16683,26 +25128,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -16710,31 +25163,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -16743,22 +25203,30 @@
     "description": "Someone closed a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo",
-      "@timestamp",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "created_at",
-      "repo_id",
-      "_document_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "About repository security advisories"
   },
@@ -16767,18 +25235,29 @@
     "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "_document_id",
+      "operation_type",
       "created_at"
     ]
   },
@@ -16787,17 +25266,30 @@
     "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -16806,21 +25298,30 @@
     "description": "GitHub withdrew a security advisory that was published in error.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -16828,18 +25329,30 @@
     "description": "Someone opened a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
       "repo_id",
-      "action",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16847,21 +25360,30 @@
     "description": "Someone published a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "repo_id",
       "_document_id",
-      "repo",
-      "business_id",
-      "business",
-      "request_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "org"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16869,17 +25391,30 @@
     "description": "Someone reopened as draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "repo",
-      "action",
-      "created_at",
       "@timestamp",
-      "request_id",
-      "actor_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "public_repo"
     ]
   },
@@ -16888,21 +25423,30 @@
     "description": "Someone edited a draft or published security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "repo_id",
-      "org_id",
       "business",
-      "actor",
-      "user_agent",
-      "created_at",
-      "_document_id",
       "business_id",
-      "repo",
-      "action",
-      "operation_type",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16910,24 +25454,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -16936,24 +25486,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -16962,25 +25518,31 @@
     "description": "Code security was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -16989,25 +25551,31 @@
     "description": "Code security was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -17016,19 +25584,30 @@
     "description": "Data use settings were disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "repo_id",
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -17037,21 +25616,30 @@
     "description": "Data use settings were enabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "org",
-      "user_id",
-      "repo_id",
       "@timestamp",
-      "request_id",
-      "actor",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org_id",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -17060,23 +25648,30 @@
     "description": "The dependency graph was disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "repo_id",
-      "operation_type",
-      "user_id",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
-      "@timestamp",
-      "org_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -17085,24 +25680,31 @@
     "description": "The dependency graph was enabled for a private repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor_id",
-      "repo_id",
+      "created_at",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -17111,19 +25713,29 @@
     "description": "Dependency updates on self-hosted runners was disabled.",
     "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -17134,23 +25746,32 @@
     "description": "Dependency updates on self-hosted runners was enabled.",
     "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners",
     "fields": [
-      "topic",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "topic",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -17161,21 +25782,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "content_type",
-      "repo",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -17183,21 +25814,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17205,21 +25846,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -17227,20 +25879,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -17248,21 +25912,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17270,19 +25945,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -17290,19 +25978,30 @@
     "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise  Organization owners can now control their repository projects settings.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "user_agent",
-      "user",
-      "business_id",
-      "business",
-      "operation_type",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -17311,20 +26010,30 @@
     "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
       "@timestamp",
-      "repo",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "repo_id",
-      "actor",
-      "request_id",
-      "programmatic_access_type"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17333,20 +26042,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
       "created_at",
-      "org_id",
-      "action",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "actor_id",
-      "repo"
+      "operation_type"
     ]
   },
   {
@@ -17354,31 +26072,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -17387,19 +26113,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -17407,8 +26144,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -17417,23 +26153,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -17458,26 +26203,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -17486,26 +26237,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -17514,23 +26271,30 @@
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -17540,23 +26304,30 @@
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -17566,24 +26337,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -17593,24 +26371,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -17619,24 +26404,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -17646,23 +26438,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -17672,23 +26471,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -17697,22 +26504,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17720,25 +26535,31 @@
     "description": "Metadata for secret scanning alerts has been disabled at the repository level",
     "docs_reference_links": "/code-security/secret-scanning/enabling-secret-scanning-features/enabling-extended-metadata-checks-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enabling extended metadata checks for your repository"
@@ -17748,24 +26569,32 @@
     "description": "Generic secrets have been disabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -17773,22 +26602,31 @@
     "description": "Generic secrets have been enabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -17797,24 +26635,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -17823,24 +26669,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -17849,19 +26703,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "repo_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -17870,24 +26736,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -17896,24 +26770,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -17922,19 +26804,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -17943,26 +26837,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -17971,26 +26870,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -17999,28 +26903,36 @@
     "description": "A code security configuration was applied to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -18028,27 +26940,35 @@
     "description": "A code security configuration failed to attach to the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -18056,28 +26976,36 @@
     "description": "A code security configuration was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -18085,28 +27013,36 @@
     "description": "A code security configuration was removed due to a change in repository or enterprise settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -18114,19 +27050,29 @@
     "description": "Dependabot security updates was disabled.",
     "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -18137,27 +27083,31 @@
     "description": "Dependabot security updates was enabled.",
     "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -18168,20 +27118,30 @@
     "description": "The repository visibility change setting was cleared for an organization or enterprise.",
     "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
       "business",
-      "action",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business_id",
-      "@timestamp",
       "user_agent",
-      "actor",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise"
   },
@@ -18190,20 +27150,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "org_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
-      "user_id",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -18211,19 +27181,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "_document_id",
       "@timestamp",
-      "user_agent",
-      "user",
-      "created_at",
-      "org",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18231,29 +27212,37 @@
     "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -18262,29 +27251,37 @@
     "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -18293,19 +27290,32 @@
     "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
-      "operation_type",
-      "request_id",
-      "repo_id",
       "@timestamp",
-      "user_agent",
-      "alert_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "alert_id",
+      "created_at",
+      "alert_number"
     ],
     "docs_reference_titles": "About Dependabot alerts"
   },
@@ -18314,23 +27324,32 @@
     "description": "A Dependabot alert was manually dismissed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "alert_id",
-      "actor",
-      "repo",
       "created_at",
-      "org",
-      "_document_id",
-      "action",
-      "actor_id",
       "dismiss_reason",
-      "user",
       "dismiss_comment",
       "alert_number",
       "actor_is_bot"
@@ -18341,21 +27360,33 @@
     "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "public_repo",
       "owner",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "token_scopes",
       "alert_number"
     ]
   },
@@ -18364,26 +27395,34 @@
     "description": "A Dependabot alert was manually reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo",
-      "alert_number",
-      "request_access_security_header"
+      "alert_number"
     ]
   },
   {
@@ -18391,21 +27430,32 @@
     "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "alert_id",
-      "repo",
-      "operation_type",
-      "action",
-      "repo_id",
-      "_document_id",
-      "user_agent",
-      "request_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "operation_type",
+      "created_at",
+      "alert_number"
     ]
   },
   {
@@ -18413,21 +27463,35 @@
     "description": "A Dependabot alert was withdrawn.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
       "created_at",
       "active",
-      "action",
-      "repository_id",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type"
     ]
   },
@@ -18436,20 +27500,30 @@
     "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
     "fields": [
-      "org",
+      "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
-      "operation_type",
-      "created_at",
-      "actor",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
   },
@@ -18458,24 +27532,31 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -18483,26 +27564,32 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -18510,23 +27597,30 @@
     "description": "Dependabot alerts was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "request_id",
-      "repo_id",
-      "action",
-      "actor_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "_document_id",
       "user_id",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -18534,23 +27628,30 @@
     "description": "Dependabot alerts was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_agent",
-      "created_at",
       "@timestamp",
-      "repo_id",
+      "_document_id",
       "action",
-      "user",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor_id",
-      "_document_id",
-      "user_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -18559,24 +27660,31 @@
     "description": "A status check was marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "org",
-      "actor_id",
       "@timestamp",
-      "business",
-      "request_id",
-      "context",
-      "repo_id",
-      "action",
-      "repo",
       "_document_id",
-      "operation_type",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "created_at",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "context",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -18585,21 +27693,31 @@
     "description": "A status check was no longer marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "actor_id",
-      "actor",
-      "created_at",
-      "context",
-      "operation_type",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "repo_id",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
       "repo",
-      "programmatic_access_type"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "context",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -18608,18 +27726,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -18628,19 +27759,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -18649,22 +27792,33 @@
     "description": "A new custom repository role was created.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "role_permissions",
       "old_role_permissions"
     ],
@@ -18675,23 +27829,34 @@
     "description": "A custom repository role was deleted.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing custom repository roles for an organization"
   },
@@ -18700,23 +27865,34 @@
     "description": "A custom repository role was edited.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "old_role_permissions",
       "old_base_role"
     ],
@@ -18727,14 +27903,28 @@
     "description": "A user was assigned to a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -18749,14 +27939,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -18770,14 +27974,28 @@
     "description": "A secret scanning alert was deleted by GitHub.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -18793,14 +28011,28 @@
     "description": "A secret scanning alert was leaked in a public repo.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -18815,22 +28047,32 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
@@ -18839,14 +28081,28 @@
     "description": "A leaked secret was reported to the secret's provider by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "created_at",
@@ -18861,28 +28117,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -18890,25 +28155,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -18916,14 +28188,28 @@
     "description": "A user was unassigned from a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -18938,14 +28224,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -18962,26 +28262,34 @@
     "description": "A request to close a secret scanning alert was approved by a user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "request_reviewer_comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -18990,25 +28298,33 @@
     "description": "N/A",
     "docs_reference_links": "A reqeust to close a secret scanning alert was canceled by a user.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "A, reqeust, to, close, a, secret, scanning, alert, was, canceled, by, a, user."
@@ -19018,27 +28334,35 @@
     "description": "N/A",
     "docs_reference_links": "A user requested to close a secret scanning alert.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "reason",
       "comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "A, user, requested, to, close, a, secret, scanning, alert."
@@ -19048,26 +28372,34 @@
     "description": "A request to close a secret scanning alert was denied by a user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "request_reviewer_comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -19076,19 +28408,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -19097,19 +28440,30 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -19118,20 +28472,30 @@
     "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -19140,19 +28504,30 @@
     "description": "Secret scanning was enabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -19161,14 +28536,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -19186,25 +28575,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -19213,24 +28610,32 @@
     "description": "A user canceled a request to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
@@ -19240,24 +28645,32 @@
     "description": "A user pushed a commit containing a secret for which there is an approved secret scanning push protection bypass request.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
@@ -19267,25 +28680,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -19295,25 +28716,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -19322,22 +28751,35 @@
     "description": "A secret scanning scan has completed on this repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "repo_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "source",
       "type",
       "source_slug",
       "type_slug",
       "started_at",
       "completed_at",
-      "repo",
       "public_repo",
-      "org",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "secret_types",
@@ -19351,10 +28793,28 @@
     "description": "A security configuration was created",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -19369,15 +28829,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -19395,22 +28848,33 @@
     "description": "A default security configuration setting for new repositories was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -19419,22 +28883,33 @@
     "description": "A default security configuration setting for new repositories was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -19443,10 +28918,28 @@
     "description": "A security configuration was deleted",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -19461,15 +28954,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -19486,15 +28972,30 @@
     "description": "A security configuration policy was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enforcement",
       "security_configuration_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -19504,10 +29005,28 @@
     "description": "A security configuration was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -19522,15 +29041,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -19548,16 +29060,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -19567,18 +29092,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -19587,16 +29125,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -19607,15 +29158,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -19625,15 +29189,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -19642,17 +29221,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -19661,17 +29253,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -19680,16 +29286,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -19699,14 +29318,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -19716,17 +29350,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -19735,17 +29382,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -19754,18 +29414,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -19774,15 +29447,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -19792,16 +29479,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -19809,15 +29509,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -19828,16 +29541,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -19847,17 +29573,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -19868,17 +29607,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "patreon_email",
       "patreon_username",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -19889,18 +29641,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -19910,16 +29673,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -19929,16 +29705,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -19950,17 +29739,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -19969,19 +29771,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -19990,21 +29805,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "user",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
       "action",
-      "user_id",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "actor_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -20013,19 +29837,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -20034,16 +29869,28 @@
     "description": "SSO lockdown for users was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -20054,16 +29901,28 @@
     "description": "SSO lockdown for users was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -20074,15 +29933,28 @@
     "description": "Automatic redirects for users to single sign-on (SSO) was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -20092,15 +29964,28 @@
     "description": "Automatic redirects for users to single sign-on (SSO) was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -20110,20 +29995,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -20131,18 +30030,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -20150,16 +30064,31 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "domain_name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -20167,21 +30096,31 @@
     "description": "A member of an organization was added to a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
-      "user",
       "@timestamp",
-      "actor_id",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "org",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -20191,22 +30130,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -20215,20 +30163,30 @@
     "description": "A team was added to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team_type",
       "team",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -20239,20 +30197,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -20261,18 +30230,31 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
-      "team",
-      "created_at",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
@@ -20282,21 +30264,32 @@
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -20305,21 +30298,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -20328,19 +30331,31 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "team",
       "org_id",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
       "operation_type",
-      "_document_id",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -20349,22 +30364,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -20373,20 +30397,30 @@
     "description": "A team was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team_type",
       "team",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -20397,22 +30431,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -20422,21 +30465,31 @@
     "description": "A repository was removed from a team's control.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "org",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -20444,21 +30497,32 @@
     "description": "A team's name was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "user_agent",
-      "created_at",
-      "team",
-      "operation_type",
-      "actor_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -20467,17 +30531,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -20486,19 +30563,30 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -20507,19 +30595,30 @@
     "description": "The Okta credentials for team synchronization with a tenant were changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -20527,28 +30626,37 @@
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
       "operation_type",
       "created_at",
-      "user_agent",
       "permission",
       "new_repo_permission",
       "new_repo_base_role",
       "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_repo_base_role"
     ]
   },
   {
@@ -20556,23 +30664,38 @@
     "description": "Triggered when a user content edit is deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_content_id",
       "user_content_type",
       "created_at",
-      "user_agent",
       "deleted_by",
       "editor_id",
-      "_document_id",
       "deleted_at",
-      "action",
-      "actor_id",
       "editor",
       "deleted_by_id",
       "deleted_content",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -20580,21 +30703,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -20602,21 +30735,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -20625,16 +30768,30 @@
     "description": "A Dependabot rule was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -20644,16 +30801,30 @@
     "description": "A Dependabot rule was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -20663,18 +30834,31 @@
     "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -20684,21 +30868,33 @@
     "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -20706,21 +30902,32 @@
     "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -20728,21 +30935,32 @@
     "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -20750,16 +30968,30 @@
     "description": "A Dependabot rule's conditions, actions, or metadata changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -20769,27 +31001,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -20798,23 +31036,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -20822,10 +31070,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -20836,20 +31102,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -20858,23 +31113,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -20884,10 +31147,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -20899,19 +31180,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -20922,10 +31193,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -20934,21 +31223,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -20958,23 +31236,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -20983,22 +31273,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -21006,21 +31307,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -21028,25 +31340,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -21054,23 +31374,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -21084,24 +31417,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -21110,10 +31452,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -21123,21 +31483,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -21147,25 +31497,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghec/organization.json b/src/audit-logs/data/ghec/organization.json
index 87b056266bce..f08e99a42520 100644
--- a/src/audit-logs/data/ghec/organization.json
+++ b/src/audit-logs/data/ghec/organization.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,29 +67,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -72,21 +103,32 @@
     "description": "Credit was accepted for a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Editing a repository security advisory"
   },
@@ -95,21 +137,32 @@
     "description": "Someone was added to the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -117,21 +170,32 @@
     "description": "Credit was declined for a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -140,21 +204,32 @@
     "description": "Someone was removed from the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -163,18 +238,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -182,17 +269,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -203,43 +301,66 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
+  },
   {
     "action": "billing.budget_create",
     "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -255,22 +376,34 @@
     "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "uuid",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -278,25 +411,37 @@
     "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
-      "request_access_security_header",
       "old_target_amount",
       "old_budget_limit_type",
       "old_alert_enabled",
@@ -310,17 +455,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -329,19 +487,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -350,15 +520,28 @@
     "description": "Azure subscription has been linked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -368,15 +551,28 @@
     "description": "Azure subscription has been unlinked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -386,18 +582,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -405,16 +614,28 @@
     "description": "The premium request paid usage policy for your GitHub account was changed.",
     "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -426,39 +647,62 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "user_id",
-      "request_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "checks.auto_trigger_disabled",
-    "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
-    "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
-    "fields": [
-      "visibility",
-      "user_agent",
-      "user",
-      "@timestamp",
-      "repo",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "checks.auto_trigger_disabled",
+    "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
+    "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -467,20 +711,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -491,17 +746,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -509,15 +776,31 @@
     "description": "Existing code scanning alerts appeared in a branch.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -527,15 +810,31 @@
     "description": "Code scanning alerts were fixed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -545,15 +844,31 @@
     "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_numbers",
       "commit_oid",
-      "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business"
+      "ref"
     ],
     "docs_reference_titles": "About code scanning"
   },
@@ -562,15 +877,29 @@
     "description": "Code scanning alerts were manually dismissed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers",
       "dismissal_approver_id"
     ],
@@ -581,19 +910,31 @@
     "description": "Dismissal of code scanning alerts was approved.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -604,19 +945,31 @@
     "description": "Dismissal of code scanning alerts was denied.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "dismissal_request_id",
-      "alert_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismissal_request_id",
+      "alert_number",
+      "public_repo",
       "created_at",
       "operation_type"
     ],
@@ -627,19 +980,31 @@
     "description": "Dismissal of code scanning alerts was requested.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -650,13 +1015,31 @@
     "description": "Code scanning alerts were seen for the first time.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -666,15 +1049,31 @@
     "description": "Code scanning alerts that were previously fixed reappeared.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -684,15 +1083,29 @@
     "description": "Code scanning alerts that were previously dismissed were reopened.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -702,14 +1115,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -719,28 +1147,34 @@
     "description": "An attempt to create a codespace from a prebuild was made.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "owner",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "user_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
       "created_at",
       "operation_type",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -748,17 +1182,30 @@
     "description": "Enterprise setting for Codespaces ownership was updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enablement",
       "organization_names",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -769,25 +1216,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -798,22 +1254,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -825,22 +1292,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -849,15 +1327,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -868,15 +1361,28 @@
     "description": "Policies were applied to codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -886,20 +1392,30 @@
     "description": "Policies were removed from codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -907,19 +1423,30 @@
     "description": "Policies were updated for codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -927,17 +1454,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -947,27 +1487,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "org",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -975,19 +1524,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -995,18 +1557,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -1015,20 +1589,30 @@
     "description": "A commit comment was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "created_at",
-      "@timestamp",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
-      "user_agent",
-      "action",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1036,21 +1620,30 @@
     "description": "A commit comment was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_id",
-      "action",
-      "@timestamp",
-      "repo",
       "org_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1058,21 +1651,33 @@
     "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "reason",
       "plan",
-      "org_id",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1080,13 +1685,28 @@
     "description": "Copilot feature settings were changed at the organization level.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1096,23 +1716,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1120,16 +1747,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -1138,24 +1779,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1163,15 +1810,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1181,20 +1841,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1202,19 +1872,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -1222,21 +1904,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1244,21 +1935,33 @@
     "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_value",
       "new_value",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1266,21 +1969,32 @@
     "description": "The excluded paths for GitHub Copilot were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "excluded_paths",
       "owner_type",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1288,14 +2002,28 @@
     "description": "Copilot custom instructions were created for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "custom_instructions"
@@ -1306,14 +2034,28 @@
     "description": "Copilot custom instructions were updated for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "custom_instructions"
@@ -1324,17 +2066,30 @@
     "description": "The plan for GitHub Copilot was updated.",
     "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_plan",
       "plan",
-      "business_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1346,20 +2101,31 @@
     "description": "The plan for GitHub Copilot was scheduled to be downgraded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "current_plan",
       "scheduled_plan"
@@ -1370,18 +2136,30 @@
     "description": "MCP Configuration for Copilot coding agent was updated for a specific repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "new_config",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_config",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1391,22 +2169,33 @@
     "description": "Specific repositories were disabled from using Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "owner_type",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1414,21 +2203,31 @@
     "description": "Specific repositories were enabled to use Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "owner_type",
-      "owner",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1438,20 +2237,32 @@
     "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_access",
       "old_access",
-      "org_id",
       "owner_type",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1461,21 +2272,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1485,19 +2305,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1507,21 +2336,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1531,18 +2369,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1555,18 +2406,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1580,14 +2444,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -1600,8 +2479,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1610,27 +2488,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1639,19 +2525,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1660,16 +2558,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repository",
-      "repository_id",
-      "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
       "operation_type",
       "definition_id"
@@ -1681,19 +2592,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1702,19 +2624,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1723,19 +2656,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1744,19 +2688,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1765,25 +2720,33 @@
     "description": "Dismissal of Dependabot alerts was approved.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -1793,25 +2756,33 @@
     "description": "Dismissal request for Dependabot alerts was canceled.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -1821,25 +2792,33 @@
     "description": "Dismissal of Dependabot alerts was requested.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -1849,25 +2828,33 @@
     "description": "Dismissal of Dependabot alerts was denied.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -1877,21 +2864,31 @@
     "description": "The default repository access for Dependabot was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "access_level",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "access_level",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -1900,17 +2897,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1918,19 +2928,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1939,19 +2960,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1959,19 +2991,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1980,19 +3023,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2000,19 +3054,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -2021,19 +3086,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2041,19 +3117,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -2062,42 +3149,61 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "discussion_comment.destroy",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "repo",
-      "org",
-      "repo_id",
-      "request_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "discussion_comment.destroy",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2105,20 +3211,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "request_id",
-      "org",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2126,22 +3242,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "actor_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "title",
-      "_document_id",
-      "created_at",
-      "repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2149,17 +3274,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2170,16 +3309,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2190,18 +3343,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
       "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2212,17 +3379,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was created.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "org_id",
       "action",
-      "request_id",
-      "org",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -2231,17 +3411,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "actor_id",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -2250,46 +3443,65 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "Managing environments for deployment"
-  },
-  {
-    "action": "environment.create",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Managing environments for deployment"
+  },
+  {
+    "action": "environment.create",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2297,28 +3509,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2327,27 +3545,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2356,25 +3582,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2383,26 +3617,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2411,21 +3652,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2434,22 +3687,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2458,25 +3721,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "public_repo",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "visibility",
+      "operation_type",
+      "created_at",
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2485,22 +3757,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2509,21 +3793,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -2534,19 +3828,30 @@
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2555,20 +3860,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2577,19 +3892,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2598,23 +3924,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2622,18 +3957,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2644,20 +3989,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2667,25 +4022,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -2693,25 +4058,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -2719,26 +4093,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -2747,25 +4130,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -2773,26 +4165,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -2800,21 +4201,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -2823,19 +4235,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -2843,21 +4268,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -2866,19 +4302,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -2889,47 +4339,70 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
-      "actor",
-      "created_at",
       "_document_id",
-      "repository_selection",
-      "integration",
-      "user_id",
-      "user",
       "action",
-      "operation_type",
-      "name",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "application_client_id"
-    ],
-    "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "repository_selection",
+      "integration",
+      "operation_type",
+      "name",
+      "application_client_id"
+    ],
+    "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
   {
     "action": "integration_installation.repositories_added",
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2940,23 +4413,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2967,21 +4452,33 @@
     "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
       "operation_type",
-      "@timestamp",
       "integration",
-      "action",
-      "user_agent",
       "reason",
-      "_document_id",
-      "org",
-      "org_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -2992,20 +4489,32 @@
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
       "@timestamp",
-      "actor_id",
-      "org",
       "_document_id",
-      "requester",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "requester",
       "created_at",
       "url",
-      "org_id",
-      "request_id",
       "operation_type",
-      "actor",
       "integration",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -3015,20 +4524,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -3038,19 +4560,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -3059,20 +4595,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -3082,20 +4631,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -3104,20 +4666,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -3126,20 +4701,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -3147,19 +4734,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -3168,19 +4768,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -3189,17 +4802,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -3212,21 +4838,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -3240,17 +4879,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -3262,19 +4914,30 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "user"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3282,19 +4945,30 @@
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3302,20 +4976,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "business",
-      "user_id",
-      "request_id",
-      "actor",
-      "user",
-      "business_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ]
   },
@@ -3324,19 +5007,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3344,24 +5038,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3369,24 +5071,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "ip_allow_list_entry",
-      "org",
-      "operation_type",
-      "created_at",
-      "active",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at",
+      "active"
     ]
   },
   {
@@ -3394,19 +5104,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "actor_id",
       "ip_allow_list_entry",
-      "active",
-      "org_id",
-      "@timestamp"
+      "active"
     ]
   },
   {
@@ -3414,22 +5137,31 @@
     "description": "A comment on an issue was deleted from the repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "org",
-      "repo",
-      "actor_id",
       "@timestamp",
-      "created_at",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "oauth_application_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -3437,24 +5169,30 @@
     "description": "A comment on an issue was pinned to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3465,19 +5203,29 @@
     "description": "A comment on an issue was unpinned from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3488,22 +5236,31 @@
     "description": "A comment on an issue (other than the initial one) changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "action",
-      "repo_id",
-      "org_id",
-      "created_at",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "request_id",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
-      "oauth_application_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -3511,20 +5268,30 @@
     "description": "An issue was marked as blocked by another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
+      "public_repo",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3535,19 +5302,30 @@
     "description": "The blocked by relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3557,20 +5335,30 @@
     "description": "An issue was marked as blocking another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3581,20 +5369,30 @@
     "description": "The blocking relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3605,21 +5403,31 @@
     "description": "An issue was deleted from the repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue",
     "fields": [
-      "user",
-      "actor_id",
-      "created_at",
-      "title",
       "@timestamp",
       "_document_id",
-      "request_id",
-      "actor",
-      "user_id",
       "action",
-      "operation_type",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type"
     ],
     "docs_reference_titles": "Deleting an issue"
   },
@@ -3628,23 +5436,33 @@
     "description": "An issue was pinned to a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
       "action",
       "actor",
-      "operation_type",
-      "owner_type",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "number",
-      "repo",
-      "event",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "owner_type",
+      "number",
+      "event"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3653,22 +5471,32 @@
     "description": "An issue was transferred to another repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "owner_type",
-      "actor_id",
       "number",
-      "repo",
       "operation_type",
-      "_document_id",
-      "repo_id",
-      "action",
-      "request_id",
-      "created_at",
-      "actor",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Transferring an issue to another repository"
   },
@@ -3677,20 +5505,32 @@
     "description": "An issue type was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issue_type_name",
       "description",
       "color",
       "enabled",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3701,20 +5541,32 @@
     "description": "An issue type was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issue_type_name",
       "description",
       "color",
       "enabled",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3725,12 +5577,29 @@
     "description": "An issue type was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "issue_type_name",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "issue_type_name",
       "description",
       "color",
       "enabled",
@@ -3738,11 +5607,6 @@
       "old_description",
       "old_color",
       "old_enabled",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3753,24 +5617,33 @@
     "description": "An issue was unpinned from a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
-      "event",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
-      "action",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "operation_type",
-      "_document_id",
-      "number",
-      "owner_type",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "token_scopes",
-      "request_access_security_header"
+      "user_agent",
+      "event",
+      "created_at",
+      "operation_type",
+      "number",
+      "owner_type"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3779,19 +5652,30 @@
     "description": "The ability for enterprise members to delete issues was disabled  Members cannot delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
-      "operation_type",
-      "request_id",
-      "actor_id",
-      "user_id",
-      "created_at",
       "_document_id",
+      "action",
       "actor",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "org_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3800,18 +5684,29 @@
     "description": "The ability for enterprise members to delete issues was enabled  Members can delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -3821,19 +5716,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user",
-      "request_id",
-      "actor",
-      "business_id",
-      "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3842,18 +5748,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3861,21 +5779,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -3883,21 +5814,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3905,22 +5849,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -3928,19 +5885,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "secondary_category",
-      "operation_type",
-      "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "secondary_category",
+      "operation_type",
+      "marketplace_listing",
       "primary_category",
       "integration"
     ]
@@ -3950,22 +5920,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -3973,22 +5956,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3996,20 +5992,30 @@
     "description": "The ability for members to publish GitHub Pages sites was disabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4018,20 +6024,30 @@
     "description": "The ability for members to publish GitHub Pages sites was enabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4040,21 +6056,30 @@
     "description": "The ability for members to publish private GitHub Pages was disabled  Members cannot publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4063,22 +6088,30 @@
     "description": "The ability for members to publish private GitHub Pages was enabled  Members can publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4087,21 +6120,30 @@
     "description": "The ability for members to publish public GitHub Pages was disabled  Members cannot publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4110,22 +6152,30 @@
     "description": "The ability for members to publish public GitHub Pages was enabled  Members can publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4134,39 +6184,61 @@
     "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "user",
-      "user_id",
-      "business",
-      "operation_type",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
+      "business",
       "business_id",
-      "@timestamp",
-      "created_at",
-      "action"
-    ],
-    "docs_reference_titles": "Enforcing repository management policies in your enterprise"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
   {
     "action": "members_can_delete_repos.disable",
     "description": "The ability for enterprise members to delete repositories was disabled  Members cannot delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "request_id",
-      "org",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "actor",
       "operation_type",
-      "org_id",
-      "action",
-      "@timestamp",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -4176,21 +6248,30 @@
     "description": "The ability for enterprise members to delete repositories was enabled  Members can delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "action",
-      "org_id",
-      "user_id",
-      "business",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
-      "org",
-      "operation_type",
-      "user_agent"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -4201,16 +6282,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -4219,21 +6311,30 @@
     "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "created_at",
-      "user_id",
       "business_id",
-      "user",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "org_id",
-      "@timestamp"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4242,19 +6343,30 @@
     "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "user_id",
-      "business",
-      "business_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "actor_id"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4263,19 +6375,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4283,21 +6407,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4307,16 +6440,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4326,18 +6472,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4347,14 +6506,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -4362,19 +6537,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -4382,18 +6568,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4401,23 +6599,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -4425,16 +6631,30 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "org_id",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4442,24 +6662,32 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
-      "repo_id",
       "operation_type",
-      "@timestamp",
-      "user_agent",
       "created_at",
-      "org",
-      "action",
-      "_document_id",
-      "repo",
-      "actor",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4467,15 +6695,28 @@
     "description": "A network configuration for a hosted compute service was created.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4493,15 +6734,28 @@
     "description": "A network configuration for a hosted compute service was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4514,15 +6768,28 @@
     "description": "A network configuration for a hosted compute service was updated.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4539,20 +6806,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4561,20 +6840,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4583,20 +6874,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4605,20 +6908,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4627,19 +6942,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4648,20 +6976,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4670,20 +7010,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4692,19 +7044,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4713,17 +7078,28 @@
     "description": "An invitation sent to an organization to join an enterprise was accepted.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4734,41 +7110,61 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
-  },
-  {
-    "action": "org.add_disallowed_two_factor_method",
-    "description": "An organization prevented access to resources by users with the given two-factor method.",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
+  },
+  {
+    "action": "org.add_disallowed_two_factor_method",
+    "description": "An organization prevented access to resources by users with the given two-factor method.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "two_factor_method",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "two_factor_method",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4779,21 +7175,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -4802,24 +7208,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4827,21 +7243,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -4849,20 +7275,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4870,22 +7306,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4893,20 +7337,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4914,22 +7368,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4937,43 +7399,64 @@
     "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "new_policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "actor_is_bot"
-    ],
-    "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
-  },
-  {
-    "action": "org.advanced_security_policy_selected_member_disabled",
-    "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
-    "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_policy",
+      "created_at",
       "operation_type",
+      "actor_is_bot"
+    ],
+    "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
+  },
+  {
+    "action": "org.advanced_security_policy_selected_member_disabled",
+    "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
+    "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
+    "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "business_id"
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4982,19 +7465,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -5004,15 +7498,28 @@
     "description": "Third-party application access for outside collaborators was disabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5023,15 +7530,28 @@
     "description": "Third-party application access for outside collaborators was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5042,15 +7562,28 @@
     "description": "The organization was archived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5060,17 +7593,30 @@
     "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
   },
@@ -5079,21 +7625,32 @@
     "description": "An export of the organization's Git events was created.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "start",
       "end",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization"
   },
@@ -5102,16 +7659,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -5120,18 +7690,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
-      "actor",
-      "user_agent",
-      "org_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "blocked_user",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -5140,19 +7723,30 @@
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -5162,22 +7756,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "email",
-      "@timestamp",
-      "actor",
-      "action",
       "operation_type",
-      "user_agent",
-      "org",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -5185,19 +7790,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -5205,16 +7821,28 @@
     "description": "Cleared two-factor authentication restrictions for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5225,23 +7853,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5249,21 +7885,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5271,23 +7917,31 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5295,23 +7949,31 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5319,10 +7981,28 @@
     "description": "Enablement for Code Security features on new repositories has been locked for this organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "action",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5332,10 +8012,28 @@
     "description": "Enablement for Code Security features on new repositories has been unlocked for this organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "action",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5345,21 +8043,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -5368,21 +8075,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -5391,20 +8107,31 @@
     "description": "Access to use Codespaces on internal and private repositories was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "enablement",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "enablement",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization"
   },
@@ -5413,21 +8140,31 @@
     "description": "Ownership and payment for codespaces was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "owner_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
   },
@@ -5436,16 +8173,29 @@
     "description": "A team has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5455,16 +8205,29 @@
     "description": "A team has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5474,19 +8237,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -5495,17 +8269,30 @@
     "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -5514,21 +8301,30 @@
     "description": "A user has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5536,21 +8332,30 @@
     "description": "A user has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5558,16 +8363,29 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
@@ -5577,17 +8395,30 @@
     "description": "The interaction limit for prior contributors only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5596,17 +8427,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5616,16 +8460,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5634,17 +8491,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5653,17 +8523,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5672,22 +8555,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -5696,17 +8587,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5717,15 +8619,28 @@
     "description": "Server statistics were exported for the organization.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5736,18 +8651,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
-      "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -5756,20 +8683,31 @@
     "description": "A GitHub Actions secret was created for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5778,20 +8716,32 @@
     "description": "A GitHub Actions variable was created for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5800,21 +8750,33 @@
     "description": "A Codespaces or Dependabot secret was created for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5822,21 +8784,30 @@
     "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "org_id",
-      "business",
-      "action",
       "@timestamp",
-      "org",
       "_document_id",
-      "business_id",
+      "action",
       "actor",
-      "token_scopes",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "actor_is_bot",
       "oauth_credential_type",
       "managed_oauth_access_id",
@@ -5852,24 +8823,32 @@
     "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
-      "created_at",
-      "org_id",
-      "business_id",
-      "operation_type",
-      "request_id",
       "_document_id",
       "action",
+      "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "token_scopes",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot",
       "oauth_credential_type",
-      "request_access_security_header",
       "managed_oauth_access_id",
       "managed_token_id",
       "managed_oauth_scopes",
@@ -5883,21 +8862,32 @@
     "description": "An owner revoked authorized credentials.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "oauth_application_id",
-      "org_id",
       "operation_type",
-      "action",
-      "business",
-      "request_id",
       "created_at",
-      "business_id",
-      "actor_id",
-      "_document_id",
-      "user_agent",
       "oauth_credential_type",
       "managed_oauth_access_id",
       "managed_token_id",
@@ -5912,18 +8902,30 @@
     "description": "An organization was deleted by a user or staff.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "org_id",
-      "org",
       "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5931,20 +8933,30 @@
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -5953,16 +8965,29 @@
     "description": "Third-party application access restrictions for an organization were disabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization"
@@ -5972,19 +8997,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -5993,14 +9029,31 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sso_url",
       "issuer",
-      "action",
-      "@timestamp",
-      "_document_id",
       "created_at",
-      "org",
       "operation_type"
     ]
   },
@@ -6009,21 +9062,30 @@
     "description": "Display of IP addresses within audit log events for the organization was disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -6032,17 +9094,30 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6050,19 +9125,30 @@
     "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6070,19 +9156,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
-      "action",
-      "actor_id",
-      "org_id"
+      "created_at"
     ]
   },
   {
@@ -6090,19 +9187,30 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -6111,17 +9219,30 @@
     "description": "Third-party application access restrictions for an organization were enabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "operation_type",
-      "org",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization"
   },
@@ -6130,19 +9251,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -6151,19 +9283,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "sso_url",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "issuer",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "sso_url",
+      "created_at",
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -6172,21 +9317,30 @@
     "description": "Display of IP addresses within audit log events for the organization was enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -6195,17 +9349,30 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
   },
@@ -6214,17 +9381,30 @@
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -6233,18 +9413,31 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
-      "org",
-      "user_agent",
-      "request_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "manager",
       "operation_type",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6252,23 +9445,32 @@
     "description": "A new user was invited to join an organization.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
     "fields": [
-      "org",
-      "user_id",
-      "invitation_id",
-      "org_id",
-      "user",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -6277,17 +9479,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6297,19 +9510,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6317,19 +9541,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6337,19 +9572,31 @@
     "description": "Access to an organization was granted for an OAuth App.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "operation_type",
-      "org_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization"
@@ -6359,20 +9606,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -6381,18 +9639,31 @@
     "description": "Access was disabled for an OAuth App that was previously approved.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization",
     "fields": [
-      "request_id",
-      "url",
-      "created_at",
-      "org_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
@@ -6402,19 +9673,31 @@
     "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "url",
-      "org_id",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "url",
       "oauth_application_name"
     ]
   },
@@ -6423,20 +9706,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -6446,16 +9740,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6463,20 +9770,31 @@
     "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "reason",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "reason",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -6485,20 +9803,30 @@
     "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -6507,19 +9835,30 @@
     "description": "An organization owner downloaded the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6528,19 +9867,30 @@
     "description": "An organization owner generated the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6549,19 +9899,30 @@
     "description": "An organization owner printed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6570,19 +9931,30 @@
     "description": "An organization owner viewed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6591,19 +9963,31 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -6612,20 +9996,31 @@
     "description": "A GitHub Actions secret was removed from an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -6634,21 +10029,31 @@
     "description": "A GitHub Actions variable was removed from an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -6657,18 +10062,29 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
@@ -6678,19 +10094,29 @@
     "description": "Removed a two-factor authentication method restriction for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "two_factor_method",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "two_factor_method",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -6701,22 +10127,32 @@
     "description": "A Codespaces or Dependabot secret was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6724,21 +10160,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6746,21 +10191,30 @@
     "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user",
-      "org_id",
-      "created_at",
-      "request_id",
       "@timestamp",
-      "action",
-      "operation_type",
-      "user_agent",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6768,40 +10222,62 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
-      "org",
-      "team",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "org.remove_self_hosted_runner",
-    "description": "A self-hosted runner was removed.",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "org.remove_self_hosted_runner",
+    "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -6810,19 +10286,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
-      "old_login",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_login",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6830,14 +10318,28 @@
     "description": "Triggered when a required workflow is created.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6848,14 +10350,28 @@
     "description": "Triggered when a required workflow is deleted.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6866,14 +10382,28 @@
     "description": "Triggered when a required workflow is updated.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6884,20 +10414,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -6906,18 +10446,29 @@
     "description": "A member's linked identity was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
       "user_id",
-      "@timestamp",
-      "action",
-      "actor_id",
       "user_agent",
-      "_document_id",
-      "request_id",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
@@ -6927,19 +10478,30 @@
     "description": "A member's SAML session was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
-      "actor_id",
-      "created_at",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
   },
@@ -6948,21 +10510,33 @@
     "description": "A self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -6972,21 +10546,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "business",
       "business_id",
-      "programmatic_access_type"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6995,20 +10579,31 @@
     "description": "A self-hosted runner group was renamed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7017,23 +10612,33 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -7042,23 +10647,31 @@
     "description": "A self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7067,19 +10680,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -7088,25 +10714,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7115,21 +10752,32 @@
     "description": "The visibility of a self-hosted runner group was updated via the REST API.",
     "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
   },
@@ -7138,10 +10786,28 @@
     "description": "Enablement for Secret Protection features on new repositories has been locked for this organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "action",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7151,10 +10817,28 @@
     "description": "Enablement for Secret Protection features on new repositories has been unlocked for this organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "action",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7164,21 +10848,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7188,21 +10881,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7212,20 +10914,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7234,22 +10946,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7258,21 +10978,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7281,21 +11010,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7304,22 +11042,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7328,21 +11074,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7351,22 +11106,30 @@
     "description": "Generic secrets have been disabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7374,22 +11137,30 @@
     "description": "Generic secrets have been enabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7397,21 +11168,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7421,21 +11201,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7445,19 +11234,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7467,21 +11267,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7491,21 +11300,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7515,19 +11333,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7537,22 +11366,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7561,22 +11398,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7585,22 +11430,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7609,21 +11462,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7632,21 +11494,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7655,22 +11526,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7679,22 +11558,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7703,12 +11590,28 @@
     "description": "The push protection setting was updated for a secret type for your organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "push_protection_setting",
       "secret_type",
       "secret_type_display_name",
@@ -7721,12 +11624,28 @@
     "description": "The push protection pattern configuration was updated for your organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at"
     ],
     "docs_reference_titles": "About push protection"
@@ -7736,26 +11655,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -7764,26 +11692,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7791,28 +11727,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7820,26 +11764,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7847,32 +11799,66 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
-      "org",
-      "runner_id",
-      "runner_name",
-      "action",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "@timestamp"
-    ],
-    "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
-  },
-  {
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_id",
+      "runner_name",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
+  },
+  {
     "action": "org.self_hosted_runner_online",
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7881,7 +11867,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -7896,18 +11903,28 @@
     "description": "The cache retention policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -7919,18 +11936,28 @@
     "description": "The cache storage policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -7942,20 +11969,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -7964,16 +12002,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -7984,18 +12035,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -8004,17 +12068,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8022,18 +12099,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -8042,18 +12131,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -8062,18 +12164,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -8082,22 +12196,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issuer",
-      "business",
       "operation_type",
       "created_at",
-      "request_id",
-      "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8105,21 +12229,32 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
   },
@@ -8128,19 +12263,30 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8151,15 +12297,28 @@
     "description": "The organization was unarchived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8169,19 +12328,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
-      "oauth_application_id",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "blocked_user",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -8190,20 +12362,32 @@
     "description": "A GitHub Actions secret was updated for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "created_at",
       "key",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -8212,23 +12396,34 @@
     "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -8237,20 +12432,32 @@
     "description": "A GitHub Actions variable was updated for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -8259,20 +12466,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -8280,18 +12499,30 @@
     "description": "The settings policy for immutable releases was updated for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_policy",
       "new_policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8302,22 +12533,33 @@
     "description": "A Codespaces or Dependabot secret was updated for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8326,20 +12568,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -8347,17 +12600,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -8367,20 +12633,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -8389,17 +12666,30 @@
     "description": "The name of the default branch was changed for new repositories in the organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
   },
@@ -8408,17 +12698,30 @@
     "description": "The repository self-hosted runners policy was updated",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_repo_runners_policy",
       "new_repo_runners_policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8429,19 +12732,32 @@
     "description": "An organization's SAML provider settings were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "issuer",
-      "org",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -8449,18 +12765,30 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
-      "actor",
-      "actor_id",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "org",
       "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
@@ -8469,21 +12797,31 @@
     "description": "An organization's custom property value was manually set for the first time.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8495,21 +12833,31 @@
     "description": "An organization's custom property value was deleted.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8521,18 +12869,30 @@
     "description": "A default label was created for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
-      "_document_id",
-      "action",
-      "created_at",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label"
   },
@@ -8541,17 +12901,30 @@
     "description": "A default label was deleted for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label"
   },
@@ -8560,17 +12933,30 @@
     "description": "A default label was edited for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label",
     "fields": [
-      "org",
-      "created_at",
       "@timestamp",
-      "actor",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label"
   },
@@ -8579,20 +12965,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "org_id",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -8601,16 +13000,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8619,14 +13033,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -8637,34 +13066,62 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "operation_type",
-      "domain_name",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
       "_document_id",
-      "actor_id"
-    ],
-    "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
-  },
-  {
-    "action": "organization_moderators.add_team",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "domain_name",
+      "created_at"
+    ],
+    "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
+  },
+  {
+    "action": "organization_moderators.add_team",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -8674,17 +13131,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8694,16 +13162,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -8713,20 +13194,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -8734,19 +13225,30 @@
     "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor",
-      "business_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
       "user_agent",
-      "_document_id",
       "created_at",
-      "operation_type",
-      "request_id",
-      "business"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -8755,19 +13257,30 @@
     "description": "Organization projects were disabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -8776,18 +13289,29 @@
     "description": "Organization projects were enabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor_id",
-      "org_id",
-      "created_at",
-      "user_id",
-      "org",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
@@ -8797,23 +13321,33 @@
     "description": "An organization role was assigned to a user or team.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About custom organization roles"
   },
@@ -8822,25 +13356,32 @@
     "description": "A custom organization role was created in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8852,25 +13393,32 @@
     "description": "A custom organization role was deleted in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8881,19 +13429,30 @@
     "description": "A user or team was unassigned an organization role.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type"
     ],
@@ -8904,26 +13463,33 @@
     "description": "A custom organization role was edited in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
       "old_role_permissions",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -8936,22 +13502,33 @@
     "description": "An organization's default project base role was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_project_base_role",
-      "new_project_base_role",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_project_base_role",
+      "new_project_base_role",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8959,20 +13536,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -8982,23 +13570,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -9007,21 +13606,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -9032,21 +13642,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -9055,20 +13678,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -9077,41 +13714,70 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
-      "owner_type",
-      "domain",
-      "state",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type"
-    ],
-    "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
-  },
-  {
-    "action": "pages_protected_domain.verify",
-    "description": "A GitHub Pages domain was verified for an organization or enterprise.",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
+      "owner_type",
+      "domain",
+      "state",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
+  },
+  {
+    "action": "pages_protected_domain.verify",
+    "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -9120,18 +13786,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9139,16 +13817,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9156,18 +13848,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9175,18 +13879,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9197,22 +13914,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9220,22 +13946,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9243,18 +13978,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9265,19 +14013,29 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
       "actor_is_bot"
     ]
@@ -9287,18 +14045,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9309,23 +14077,34 @@
     "description": "A personal access token expiration limit was set.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "token_expiration",
       "old_token_expiration",
       "exempt_administrators",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9333,21 +14112,32 @@
     "description": "A personal access token expiration limit was unset.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "programmatic_access_type",
-      "old_token_expiration",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_token_expiration",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9355,17 +14145,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9376,18 +14179,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9399,17 +14215,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9421,20 +14250,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9446,20 +14284,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9471,20 +14318,29 @@
     "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9496,20 +14352,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9521,15 +14386,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9539,17 +14419,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9559,15 +14450,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9577,19 +14483,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "business_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9597,23 +14514,30 @@
     "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "created_at",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
-      "repo",
       "action",
-      "user_agent",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "request_id",
-      "user_id",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9621,23 +14545,30 @@
     "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "repo",
-      "org",
-      "business",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org_id",
-      "created_at",
-      "business_id"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9645,17 +14576,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9665,17 +14607,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9685,17 +14638,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9705,17 +14669,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9725,17 +14700,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -9745,17 +14733,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9763,25 +14764,36 @@
     "description": "A project's base role was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_project_base_role",
       "new_project_base_role",
       "project_number",
       "public_project",
-      "business",
       "project_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9789,20 +14801,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -9812,25 +14835,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -9838,20 +14873,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9859,25 +14906,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9885,17 +14944,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9903,17 +14975,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9921,18 +15006,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -9941,18 +15038,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -9961,19 +15070,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -9981,17 +15101,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -10003,22 +15136,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -10026,19 +15168,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10046,17 +15199,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10064,18 +15230,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -10083,20 +15262,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10104,18 +15293,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -10124,18 +15325,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -10144,16 +15357,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -10165,21 +15391,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -10187,22 +15425,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -10211,29 +15459,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10241,24 +15494,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "repo_id",
-      "user_id",
       "@timestamp",
-      "user_agent",
-      "repo",
-      "name",
-      "org_id",
-      "user",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -10269,21 +15530,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -10294,22 +15565,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10317,24 +15598,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "actor",
-      "oauth_application_id",
-      "authorized_actors_only",
-      "authorized_actors",
-      "created_at",
-      "user_agent",
-      "name",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "authorized_actors_only",
+      "authorized_actors",
+      "created_at",
+      "name",
+      "operation_type"
     ]
   },
   {
@@ -10342,30 +15633,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -10375,28 +15673,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -10407,23 +15713,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -10431,22 +15746,32 @@
     "description": "Branch deletion was enabled or disabled for a protected branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "operation_type",
-      "request_id",
-      "repo",
       "@timestamp",
-      "org_id",
-      "org",
-      "action",
-      "allow_deletions_enforcement_level",
       "_document_id",
-      "created_at",
-      "actor_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_deletions_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10454,23 +15779,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "actor_id",
-      "name",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo",
-      "operation_type",
-      "request_id",
-      "allow_force_pushes_enforcement_level",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_force_pushes_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10478,24 +15812,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -10504,22 +15847,32 @@
     "description": "Required linear commit history was enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "operation_type",
       "actor",
-      "linear_history_requirement_enforcement_level",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "linear_history_requirement_enforcement_level",
       "name",
-      "org_id",
-      "repo_id",
-      "org",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -10527,24 +15880,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "lock_allows_fetch_and_merge",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10553,27 +15915,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10582,18 +15951,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -10604,24 +15986,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -10629,25 +16020,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -10655,22 +16053,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -10678,22 +16086,33 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
   },
@@ -10702,22 +16121,32 @@
     "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "required_approving_review_count",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10725,25 +16154,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
     ]
   },
   {
@@ -10751,22 +16187,32 @@
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
       "action",
       "actor",
       "actor_id",
-      "signature_requirement_enforcement_level",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "programmatic_access_type"
+      "operation_type",
+      "name",
+      "created_at",
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -10774,22 +16220,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "created_at",
-      "repo_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "name",
-      "actor",
-      "repo",
       "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
+      "strict_required_status_checks_policy"
     ]
   },
   {
@@ -10797,23 +16253,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -10822,24 +16289,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -10848,20 +16326,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10870,21 +16362,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -10894,22 +16399,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10918,25 +16435,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10945,23 +16472,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
-      "created_at",
-      "key",
-      "fingerprint",
-      "actor_id",
       "actor",
-      "title",
-      "user_agent",
-      "user_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "read_only",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "key",
+      "fingerprint",
+      "title",
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10970,18 +16508,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -10991,21 +16543,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -11014,19 +16577,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -11037,23 +16613,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -11063,17 +16651,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11081,19 +16683,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -11101,19 +16716,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -11123,21 +16751,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -11146,27 +16785,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
-      "pull_request_url",
-      "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
+      "pull_request_url",
+      "pull_request_title",
+      "public_repo",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -11174,23 +16820,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -11199,18 +16857,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -11218,19 +16890,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -11240,20 +16924,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
-      "repo",
-      "created_at",
-      "request_id",
-      "comment_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "comment_id",
+      "operation_type"
     ]
   },
   {
@@ -11261,18 +16956,31 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "_document_id",
-      "@timestamp",
-      "comment_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "comment_id"
     ]
   },
   {
@@ -11280,21 +16988,33 @@
     "description": "A review on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -11302,20 +17022,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -11324,19 +17057,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -11346,45 +17093,64 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "created_at",
-      "user_agent",
-      "actor",
-      "action",
-      "repo",
-      "visibility",
       "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
-    ],
-    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
-  },
-  {
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility",
+      "previous_visibility"
+    ],
+    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
+  },
+  {
     "action": "repo.actions_enabled",
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -11393,25 +17159,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -11420,23 +17193,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -11445,24 +17226,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -11471,23 +17259,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -11497,22 +17293,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -11521,19 +17326,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11542,24 +17360,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -11568,24 +17396,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11593,24 +17429,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11618,24 +17462,32 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11643,24 +17495,32 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11668,23 +17528,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11695,17 +17564,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -11715,17 +17596,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -11735,25 +17628,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11762,26 +17661,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11790,25 +17697,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "query_suite",
-      "threat_model",
-      "languages",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "query_suite",
+      "threat_model",
+      "languages",
+      "public_repo",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -11818,19 +17734,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to this repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -11839,19 +17766,30 @@
     "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11859,17 +17797,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11878,15 +17829,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -11897,16 +17861,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11916,17 +17893,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11936,19 +17926,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11957,17 +17958,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11976,27 +17990,33 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "public_repo",
+      "created_at",
+      "operation_type"
+    ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
   {
@@ -12004,30 +18024,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -12037,20 +18062,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12059,25 +18095,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12086,23 +18130,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12110,25 +18165,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -12138,23 +18202,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -12164,24 +18237,32 @@
     "description": "The setting for immutable releases was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -12190,20 +18271,30 @@
     "description": "The setting for immutable releases was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12214,23 +18305,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -12238,21 +18339,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12260,21 +18371,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -12282,22 +18403,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -12305,21 +18435,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -12327,20 +18467,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -12348,22 +18499,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12371,18 +18531,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -12390,22 +18564,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -12413,21 +18597,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12435,18 +18629,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -12455,22 +18661,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12479,24 +18694,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12505,23 +18728,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12529,26 +18762,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -12557,21 +18795,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -12580,25 +18827,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12606,22 +18859,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -12630,25 +18893,34 @@
     "description": "A branch was renamed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "old_branch",
-      "new_branch",
-      "default_branch",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "old_branch",
+      "new_branch",
+      "default_branch",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch"
@@ -12658,19 +18930,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12678,17 +18961,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12697,17 +18995,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12716,7 +19029,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -12731,22 +19065,30 @@
     "description": "The cache retention policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12758,22 +19100,30 @@
     "description": "The cache storage policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12785,23 +19135,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -12811,20 +19170,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -12835,21 +19205,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -12858,22 +19239,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -12882,21 +19273,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -12905,22 +19307,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -12931,16 +19343,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
       "created_at",
-      "actor",
-      "repo_id",
-      "action",
-      "org",
-      "org_id",
-      "request_id",
-      "repo",
       "operation_type"
     ]
   },
@@ -12950,22 +19373,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -12974,23 +19408,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -13000,19 +19444,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -13020,21 +19474,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -13043,24 +19507,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13068,25 +19541,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -13095,24 +19575,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13121,25 +19611,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -13148,22 +19646,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13172,26 +19679,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -13199,31 +19714,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13232,22 +19754,30 @@
     "description": "Someone closed a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories",
     "fields": [
-      "actor",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "created_at",
-      "repo_id",
-      "_document_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "About repository security advisories"
   },
@@ -13256,18 +19786,29 @@
     "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "_document_id",
+      "operation_type",
       "created_at"
     ]
   },
@@ -13276,17 +19817,30 @@
     "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -13295,21 +19849,30 @@
     "description": "GitHub withdrew a security advisory that was published in error.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13317,18 +19880,30 @@
     "description": "Someone opened a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
       "repo_id",
-      "action",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13336,21 +19911,30 @@
     "description": "Someone published a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "repo_id",
       "_document_id",
-      "repo",
-      "business_id",
-      "business",
-      "request_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "org"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13358,17 +19942,30 @@
     "description": "Someone reopened as draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "repo",
-      "action",
+      "operation_type",
       "created_at",
-      "@timestamp",
-      "request_id",
-      "actor_id",
-      "_document_id",
-      "actor",
-      "repo_id",
       "public_repo"
     ]
   },
@@ -13377,21 +19974,30 @@
     "description": "Someone edited a draft or published security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "repo_id",
-      "org_id",
       "business",
-      "actor",
-      "user_agent",
-      "created_at",
-      "_document_id",
       "business_id",
-      "repo",
-      "action",
-      "operation_type",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13399,24 +20005,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -13425,24 +20037,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -13451,25 +20069,31 @@
     "description": "Code security was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13478,25 +20102,31 @@
     "description": "Code security was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13505,19 +20135,30 @@
     "description": "Data use settings were disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "repo_id",
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -13526,21 +20167,30 @@
     "description": "Data use settings were enabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "org",
-      "user_id",
-      "repo_id",
       "@timestamp",
-      "request_id",
-      "actor",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org_id",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -13549,23 +20199,30 @@
     "description": "The dependency graph was disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "repo_id",
-      "operation_type",
-      "user_id",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
-      "@timestamp",
-      "org_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -13574,24 +20231,31 @@
     "description": "The dependency graph was enabled for a private repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "org_id",
-      "action",
-      "repo",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor_id",
-      "repo_id",
+      "created_at",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13600,19 +20264,29 @@
     "description": "Dependency updates on self-hosted runners was disabled.",
     "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -13623,23 +20297,32 @@
     "description": "Dependency updates on self-hosted runners was enabled.",
     "docs_reference_links": "code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/managing-dependabot-on-self-hosted-runners",
     "fields": [
-      "topic",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "topic",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -13650,21 +20333,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -13672,21 +20365,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13694,21 +20397,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -13716,20 +20430,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -13737,21 +20463,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13759,19 +20496,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -13779,17 +20529,31 @@
     "description": "An organization has reached their repository limit.",
     "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "limit",
       "count",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -13800,17 +20564,31 @@
     "description": "An organization is approaching their repository limit.",
     "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "limit",
       "count",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -13821,19 +20599,30 @@
     "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise  Organization owners can now control their repository projects settings.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "user_agent",
-      "user",
-      "business_id",
-      "business",
-      "operation_type",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -13842,20 +20631,30 @@
     "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
       "@timestamp",
-      "repo",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "repo_id",
-      "actor",
-      "request_id",
-      "programmatic_access_type"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13864,20 +20663,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
       "created_at",
-      "org_id",
-      "action",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "actor_id",
-      "repo"
+      "operation_type"
     ]
   },
   {
@@ -13885,31 +20693,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -13918,19 +20734,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -13938,8 +20765,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -13948,23 +20774,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -13989,26 +20824,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -14017,26 +20858,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -14044,24 +20891,31 @@
     "action": "repository_secret_scanning_custom_pattern.create",
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
-    "fields": [
-      "user_agent",
-      "request_id",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14071,23 +20925,30 @@
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14097,24 +20958,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14124,24 +20992,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -14150,24 +21025,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14177,23 +21059,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14203,23 +21092,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14228,22 +21125,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14251,25 +21156,31 @@
     "description": "Metadata for secret scanning alerts has been disabled at the repository level",
     "docs_reference_links": "/code-security/secret-scanning/enabling-secret-scanning-features/enabling-extended-metadata-checks-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enabling extended metadata checks for your repository"
@@ -14279,24 +21190,32 @@
     "description": "Generic secrets have been disabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14304,22 +21223,31 @@
     "description": "Generic secrets have been enabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14328,24 +21256,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -14354,24 +21290,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -14380,19 +21324,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14401,24 +21357,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14427,24 +21391,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14453,19 +21425,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14474,26 +21458,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "public_repo",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14502,26 +21491,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14530,28 +21524,36 @@
     "description": "A code security configuration was applied to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14559,27 +21561,35 @@
     "description": "A code security configuration failed to attach to the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14587,28 +21597,36 @@
     "description": "A code security configuration was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14616,28 +21634,36 @@
     "description": "A code security configuration was removed due to a change in repository or enterprise settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14645,19 +21671,29 @@
     "description": "Dependabot security updates was disabled.",
     "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -14668,27 +21704,31 @@
     "description": "Dependabot security updates was enabled.",
     "docs_reference_links": "/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -14699,20 +21739,30 @@
     "description": "The repository visibility change setting was cleared for an organization or enterprise.",
     "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
       "business",
-      "action",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business_id",
-      "@timestamp",
       "user_agent",
-      "actor",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise"
   },
@@ -14721,20 +21771,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org_id",
-      "created_at",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "org",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
       "user_id",
-      "action",
-      "request_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14742,19 +21802,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "_document_id",
       "@timestamp",
-      "user_agent",
-      "user",
-      "created_at",
-      "org",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14762,29 +21833,37 @@
     "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -14793,29 +21872,37 @@
     "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -14824,19 +21911,32 @@
     "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
-      "operation_type",
-      "request_id",
-      "repo_id",
       "@timestamp",
-      "user_agent",
-      "alert_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "alert_id",
+      "created_at",
+      "alert_number"
     ],
     "docs_reference_titles": "About Dependabot alerts"
   },
@@ -14845,23 +21945,32 @@
     "description": "A Dependabot alert was manually dismissed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "alert_id",
-      "actor",
-      "repo",
       "created_at",
-      "org",
-      "_document_id",
-      "action",
-      "actor_id",
       "dismiss_reason",
-      "user",
       "dismiss_comment",
       "alert_number",
       "actor_is_bot"
@@ -14872,21 +21981,33 @@
     "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "public_repo",
       "owner",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "token_scopes",
       "alert_number"
     ]
   },
@@ -14895,26 +22016,34 @@
     "description": "A Dependabot alert was manually reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo",
-      "alert_number",
-      "request_access_security_header"
+      "alert_number"
     ]
   },
   {
@@ -14922,21 +22051,32 @@
     "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "alert_id",
-      "repo",
-      "operation_type",
-      "action",
-      "repo_id",
-      "_document_id",
-      "user_agent",
-      "request_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "operation_type",
+      "created_at",
+      "alert_number"
     ]
   },
   {
@@ -14944,21 +22084,35 @@
     "description": "A Dependabot alert was withdrawn.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
       "created_at",
       "active",
-      "action",
-      "repository_id",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type"
     ]
   },
@@ -14967,20 +22121,30 @@
     "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
     "fields": [
-      "org",
+      "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
-      "operation_type",
-      "created_at",
-      "actor",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
   },
@@ -14989,24 +22153,31 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -15014,26 +22185,32 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15041,23 +22218,30 @@
     "description": "Dependabot alerts was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "request_id",
-      "repo_id",
-      "action",
-      "actor_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "_document_id",
       "user_id",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15065,23 +22249,30 @@
     "description": "Dependabot alerts was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_agent",
-      "created_at",
       "@timestamp",
-      "repo_id",
+      "_document_id",
       "action",
-      "user",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor_id",
-      "_document_id",
-      "user_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -15090,24 +22281,31 @@
     "description": "A status check was marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "org",
-      "actor_id",
       "@timestamp",
-      "business",
-      "request_id",
-      "context",
-      "repo_id",
-      "action",
-      "repo",
       "_document_id",
-      "operation_type",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "created_at",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "context",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -15116,21 +22314,31 @@
     "description": "A status check was no longer marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "actor_id",
-      "actor",
-      "created_at",
-      "context",
-      "operation_type",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "repo_id",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
       "repo",
-      "programmatic_access_type"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "context",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -15139,18 +22347,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "business",
-      "business_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -15159,19 +22380,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -15180,22 +22413,33 @@
     "description": "A new custom repository role was created.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "role_permissions",
       "old_role_permissions"
     ],
@@ -15206,23 +22450,34 @@
     "description": "A custom repository role was deleted.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing custom repository roles for an organization"
   },
@@ -15231,23 +22486,34 @@
     "description": "A custom repository role was edited.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "old_role_permissions",
       "old_base_role"
     ],
@@ -15258,14 +22524,28 @@
     "description": "A user was assigned to a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15280,14 +22560,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15301,14 +22595,28 @@
     "description": "A secret scanning alert was deleted by GitHub.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15324,14 +22632,28 @@
     "description": "A secret scanning alert was leaked in a public repo.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15346,38 +22668,62 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
   {
     "action": "secret_scanning_alert.report",
     "description": "A leaked secret was reported to the secret's provider by secret scanning.",
-    "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts",
-    "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+    "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "created_at",
@@ -15392,28 +22738,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -15421,25 +22776,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -15447,14 +22809,28 @@
     "description": "A user was unassigned from a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15469,14 +22845,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -15493,26 +22883,34 @@
     "description": "A request to close a secret scanning alert was approved by a user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "request_reviewer_comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15521,25 +22919,33 @@
     "description": "N/A",
     "docs_reference_links": "A reqeust to close a secret scanning alert was canceled by a user.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "A, reqeust, to, close, a, secret, scanning, alert, was, canceled, by, a, user."
@@ -15549,27 +22955,35 @@
     "description": "N/A",
     "docs_reference_links": "A user requested to close a secret scanning alert.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "reason",
       "comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "A, user, requested, to, close, a, secret, scanning, alert."
@@ -15579,26 +22993,34 @@
     "description": "A request to close a secret scanning alert was denied by a user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "request_reviewer_comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -15607,19 +23029,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15628,19 +23061,30 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15649,20 +23093,30 @@
     "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15671,19 +23125,30 @@
     "description": "Secret scanning was enabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15692,14 +23157,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -15717,25 +23196,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -15744,24 +23231,32 @@
     "description": "A user canceled a request to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
@@ -15771,24 +23266,32 @@
     "description": "A user pushed a commit containing a secret for which there is an approved secret scanning push protection bypass request.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
@@ -15798,25 +23301,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -15826,25 +23337,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -15853,22 +23372,35 @@
     "description": "A secret scanning scan has completed on this repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "repo_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "source",
       "type",
       "source_slug",
       "type_slug",
       "started_at",
       "completed_at",
-      "repo",
       "public_repo",
-      "org",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "secret_types",
@@ -15882,10 +23414,28 @@
     "description": "A security configuration was created",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15900,15 +23450,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15926,22 +23469,33 @@
     "description": "A default security configuration setting for new repositories was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15950,22 +23504,33 @@
     "description": "A default security configuration setting for new repositories was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15974,10 +23539,28 @@
     "description": "A security configuration was deleted",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15992,15 +23575,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -16017,15 +23593,30 @@
     "description": "A security configuration policy was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enforcement",
       "security_configuration_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16035,10 +23626,28 @@
     "description": "A security configuration was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -16053,15 +23662,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -16079,16 +23681,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16098,18 +23713,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "org",
-      "org_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -16118,16 +23746,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16137,15 +23778,28 @@
     "description": "An agreement for invoiced billing for GitHub Sponsors was signed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -16157,15 +23811,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -16175,15 +23842,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -16192,17 +23874,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -16211,17 +23906,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -16230,16 +23939,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -16249,14 +23971,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -16266,17 +24003,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -16285,17 +24035,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -16304,18 +24067,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16324,15 +24100,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -16342,16 +24132,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16359,15 +24162,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -16378,16 +24194,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -16397,17 +24226,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -16418,17 +24260,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -16439,18 +24294,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16460,16 +24326,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16479,16 +24358,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "sponsors_listing_id",
       "created_at",
       "operation_type"
     ]
@@ -16500,17 +24392,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16519,19 +24424,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16540,21 +24458,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "user",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
       "action",
-      "user_id",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "actor_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16563,19 +24490,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16584,15 +24522,28 @@
     "description": "Dependabot encrypted config was read.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "public_repo"
@@ -16603,20 +24554,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16624,18 +24589,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -16643,16 +24623,31 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "domain_name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16660,23 +24655,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16684,23 +24689,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16708,23 +24723,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16732,23 +24757,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16756,21 +24791,31 @@
     "description": "A member of an organization was added to a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
-      "user",
       "@timestamp",
-      "actor_id",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "org",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -16780,22 +24825,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -16804,20 +24858,30 @@
     "description": "A team was added to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team_type",
       "team",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -16828,20 +24892,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -16850,18 +24925,31 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
       "created_at",
       "operation_type",
-      "actor_id",
-      "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
@@ -16871,21 +24959,32 @@
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -16894,21 +24993,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -16917,19 +25026,31 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "team",
       "org_id",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
       "operation_type",
-      "_document_id",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -16938,19 +25059,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "actor",
-      "action",
-      "operation_type",
-      "team",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -16958,19 +25091,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "actor_id",
       "_document_id",
-      "team",
-      "created_at",
-      "org_id",
       "action",
-      "request_id",
-      "user_agent",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_access_security_header"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "team",
+      "created_at"
     ]
   },
   {
@@ -16978,22 +25123,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "team",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17001,22 +25155,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -17025,20 +25188,30 @@
     "description": "A team was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team_type",
       "team",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -17049,22 +25222,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -17074,43 +25256,64 @@
     "description": "A repository was removed from a team's control.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "org",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
     "action": "team.rename",
-    "description": "A team's name was changed.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "name",
-      "user_agent",
-      "created_at",
-      "team",
-      "operation_type",
-      "actor_id",
-      "org",
+    "description": "A team's name was changed.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -17119,17 +25322,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -17138,19 +25354,30 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -17159,19 +25386,30 @@
     "description": "The Okta credentials for team synchronization with a tenant were changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -17179,28 +25417,37 @@
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
       "operation_type",
       "created_at",
-      "user_agent",
       "permission",
       "new_repo_permission",
       "new_repo_base_role",
       "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_repo_base_role"
     ]
   },
   {
@@ -17208,23 +25455,38 @@
     "description": "Triggered when a user content edit is deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_content_id",
       "user_content_type",
       "created_at",
-      "user_agent",
       "deleted_by",
       "editor_id",
-      "_document_id",
       "deleted_at",
-      "action",
-      "actor_id",
       "editor",
       "deleted_by_id",
       "deleted_content",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -17232,16 +25494,30 @@
     "description": "A Dependabot rule was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17251,16 +25527,30 @@
     "description": "A Dependabot rule was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17270,18 +25560,31 @@
     "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17291,21 +25594,33 @@
     "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17313,21 +25628,32 @@
     "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -17335,21 +25661,32 @@
     "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -17357,16 +25694,30 @@
     "description": "A Dependabot rule's conditions, actions, or metadata changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17376,27 +25727,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -17405,23 +25762,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17429,10 +25796,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17443,20 +25828,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -17465,23 +25839,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17491,10 +25873,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17506,19 +25906,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -17529,10 +25919,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17541,21 +25949,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -17565,23 +25962,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -17590,22 +25999,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -17613,21 +26033,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -17635,25 +26066,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -17661,23 +26100,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -17691,24 +26143,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -17717,10 +26178,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17730,21 +26209,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -17754,25 +26223,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghec/user.json b/src/audit-logs/data/ghec/user.json
index d12883c8b51a..86bcc2b8bf74 100644
--- a/src/audit-logs/data/ghec/user.json
+++ b/src/audit-logs/data/ghec/user.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,17 +67,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
-      "user_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -61,18 +98,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
+      "token_scopes",
       "user",
-      "request_id",
-      "_document_id",
-      "user_agent",
-      "actor",
       "user_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -80,18 +129,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "token_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -99,29 +160,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -129,18 +196,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -148,21 +227,34 @@
     "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -178,22 +270,34 @@
     "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "uuid",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -201,25 +305,37 @@
     "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
-      "request_access_security_header",
       "old_target_amount",
       "old_budget_limit_type",
       "old_alert_enabled",
@@ -233,17 +349,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -252,19 +381,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -273,15 +414,28 @@
     "description": "Azure subscription has been linked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -291,15 +445,28 @@
     "description": "Azure subscription has been unlinked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -309,18 +476,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -328,16 +508,28 @@
     "description": "The premium request paid usage policy for your GitHub account was changed.",
     "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -349,18 +541,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -368,15 +572,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -386,26 +603,36 @@
     "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -413,24 +640,34 @@
     "description": "A CSV export was requested on the \"Coverage\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -438,26 +675,36 @@
     "description": "A CSV export was requested on the \"Overview Dashboard\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "user",
-      "user_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -465,20 +712,31 @@
     "description": "A CSV export was requested on the \"Risk\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -489,17 +747,29 @@
     "description": "The cache retention policy for GitHub Actions was set for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -511,17 +781,29 @@
     "description": "The cache storage policy for GitHub Actions was set for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -533,17 +815,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -554,20 +849,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -576,19 +883,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -597,19 +917,31 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -618,20 +950,32 @@
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -640,19 +984,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -661,20 +1017,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -683,20 +1050,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -707,17 +1085,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -725,14 +1115,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -742,25 +1147,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -771,22 +1185,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -798,22 +1223,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -822,15 +1258,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -841,17 +1292,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -861,27 +1325,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "owner",
-      "pull_request_id",
-      "machine_type",
-      "user_id",
-      "user",
-      "devcontainer_path",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
+      "machine_type",
+      "devcontainer_path",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -889,19 +1362,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -909,18 +1395,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -929,23 +1427,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -953,16 +1458,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -971,24 +1490,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -996,15 +1521,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1014,20 +1552,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1035,19 +1583,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -1055,21 +1615,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1077,22 +1646,33 @@
     "description": "Specific repositories were disabled from using Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "owner_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1100,21 +1680,31 @@
     "description": "Specific repositories were enabled to use Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "owner_type",
-      "owner",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1124,20 +1714,32 @@
     "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_access",
       "old_access",
-      "org_id",
       "owner_type",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1147,21 +1749,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1171,19 +1782,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1193,21 +1813,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1217,19 +1846,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1238,19 +1878,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1259,19 +1910,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1280,19 +1942,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1301,25 +1974,33 @@
     "description": "Dismissal of Dependabot alerts was approved.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -1329,25 +2010,33 @@
     "description": "Dismissal request for Dependabot alerts was canceled.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -1357,25 +2046,33 @@
     "description": "Dismissal of Dependabot alerts was requested.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -1385,25 +2082,33 @@
     "description": "Dismissal of Dependabot alerts was denied.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About Dependabot alerts"
@@ -1413,17 +2118,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1431,19 +2149,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1452,19 +2181,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1472,19 +2212,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1493,19 +2244,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1513,19 +2275,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1534,19 +2307,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1554,19 +2338,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1575,20 +2370,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1596,22 +2401,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1620,22 +2434,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1643,28 +2467,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1673,27 +2503,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1702,25 +2540,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1729,26 +2575,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1757,21 +2610,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1780,22 +2645,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1804,25 +2679,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1831,22 +2715,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1855,21 +2751,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -1880,21 +2786,32 @@
     "description": "A gist was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "gist_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "visibility",
-      "action",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ]
   },
   {
@@ -1902,42 +2819,65 @@
     "description": "A gist was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "gist_id",
-      "visibility",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "user",
-      "request_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "user_agent",
-      "@timestamp",
-      "programmatic_access_type"
-    ]
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "gist_id",
+      "visibility",
+      "created_at",
+      "operation_type"
+    ]
   },
   {
     "action": "gist.visibility_change",
     "description": "The visibility of a gist was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "user",
-      "gist_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "visibility",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "gist_id",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -1945,22 +2885,33 @@
     "description": "An SSH key was added to a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1969,23 +2920,34 @@
     "description": "An SSH key was removed from a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
       "explanation",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1994,23 +2956,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2018,18 +2989,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2040,20 +3021,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2063,18 +3054,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "user",
-      "operation_type",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2082,18 +3085,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2101,25 +3116,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "name",
-      "events",
-      "active",
-      "active_was",
-      "hook_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "events",
+      "active",
+      "active_was",
+      "hook_id",
+      "operation_type"
     ]
   },
   {
@@ -2127,25 +3152,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -2153,26 +3187,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -2181,25 +3224,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -2207,26 +3259,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -2234,21 +3295,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -2257,19 +3329,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -2277,21 +3362,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -2300,19 +3396,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -2323,20 +3433,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2346,24 +3468,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2374,23 +3507,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2401,20 +3546,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2424,19 +3582,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -2445,20 +3617,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -2468,20 +3653,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -2490,20 +3688,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -2512,40 +3723,65 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "name",
-      "integration",
-      "user",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "integration.revoke_all_tokens",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "integration.revoke_all_tokens",
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2554,19 +3790,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2575,17 +3824,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2598,21 +3860,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -2626,17 +3901,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2648,20 +3936,30 @@
     "description": "An issue was marked as blocked by another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2672,19 +3970,30 @@
     "description": "The blocked by relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2694,20 +4003,30 @@
     "description": "An issue was marked as blocking another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2718,20 +4037,30 @@
     "description": "The blocking relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
+      "public_repo",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2742,18 +4071,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2761,21 +4102,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -2783,21 +4137,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2805,22 +4172,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -2828,19 +4208,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -2851,21 +4244,36 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
       "marketplace_listing",
       "has_free_trial",
-      "user_agent",
-      "request_id",
-      "actor_id",
       "yearly_price_in_cents",
       "description",
       "bullets",
       "monthly_price_in_cents",
-      "marketplace_listing_plan",
-      "_document_id"
+      "marketplace_listing_plan"
     ]
   },
   {
@@ -2873,22 +4281,37 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "marketplace_listing_plan",
       "marketplace_listing",
       "description",
       "bullets",
       "has_free_trial",
       "created_at",
-      "actor_id",
       "operation_type",
-      "_document_id",
-      "action",
-      "user_agent",
-      "request_id",
-      "actor",
       "monthly_price_in_cents",
-      "yearly_price_in_cents",
-      "@timestamp"
+      "yearly_price_in_cents"
     ]
   },
   {
@@ -2896,21 +4319,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "marketplace_listing_plan",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "marketplace_listing_plan",
       "description",
       "yearly_price_in_cents",
-      "@timestamp",
       "created_at",
-      "actor_id",
       "bullets",
       "has_free_trial",
       "marketplace_listing",
-      "user_agent",
       "monthly_price_in_cents",
-      "action",
       "operation_type"
     ]
   },
@@ -2919,45 +4357,73 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "monthly_price_in_cents",
-      "marketplace_listing",
+      "@timestamp",
       "_document_id",
       "action",
-      "description",
-      "bullets",
-      "yearly_price_in_cents",
-      "request_id",
-      "actor_id",
-      "has_free_trial",
-      "marketplace_listing_plan",
-      "user_agent",
-      "@timestamp",
-      "operation_type",
       "actor",
-      "created_at"
-    ]
-  },
-  {
-    "action": "marketplace_listing.redraft",
-    "description": "A listing was sent back to draft state.",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "monthly_price_in_cents",
+      "marketplace_listing",
+      "description",
+      "bullets",
+      "yearly_price_in_cents",
+      "has_free_trial",
+      "marketplace_listing_plan",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "marketplace_listing.redraft",
+    "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -2965,22 +4431,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2988,19 +4467,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3008,21 +4499,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3032,16 +4532,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3051,18 +4564,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3072,14 +4598,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -3087,19 +4629,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -3107,42 +4660,62 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "org",
-      "created_at",
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
-      "request_access_security_header"
-    ]
-  },
-  {
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
     "action": "migration.create",
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -3150,20 +4723,30 @@
     "description": "An OAuth access token was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
     "fields": [
-      "_document_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "user",
-      "user_id",
-      "created_at",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "request_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
@@ -3174,19 +4757,30 @@
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "explanation",
-      "hashed_token",
-      "actor_id",
-      "token_scopes",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
@@ -3196,19 +4790,30 @@
     "description": "An OAuth access token was regenerated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "_document_id",
-      "created_at",
       "@timestamp",
-      "operation_type",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ]
   },
@@ -3217,16 +4822,28 @@
     "description": "An OAuth access token was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "request_access_security_header",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
       "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3236,18 +4853,30 @@
     "description": "An OAuth access token was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3255,20 +4884,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3277,20 +4918,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3299,42 +4952,66 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application",
-      "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
-  },
-  {
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+  },
+  {
     "action": "oauth_application.remove_client_secret",
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3343,19 +5020,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3364,20 +5054,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3386,20 +5088,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3408,19 +5122,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3429,24 +5156,31 @@
     "description": "An authorization for an OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "user_id",
-      "actor",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
       "actor_id",
-      "user",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "actor_is_bot",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -3456,20 +5190,31 @@
     "description": "An authorization for an OAuth application was deleted.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "actor",
       "created_at",
       "explanation",
-      "user",
-      "user_id",
-      "org_id",
-      "action",
-      "actor_id",
-      "token_scopes",
       "actor_is_bot",
       "oauth_application_name"
     ],
@@ -3480,20 +5225,31 @@
     "description": "An authorization for an OAuth application was updated.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
-      "actor_id",
       "user_agent",
-      "@timestamp",
       "operation_type",
-      "action",
-      "user",
       "created_at",
-      "_document_id",
       "actor_is_bot",
-      "request_access_security_header",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -3503,21 +5259,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -3526,24 +5292,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3551,20 +5327,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3572,22 +5358,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3595,20 +5389,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3616,22 +5420,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3639,21 +5451,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3661,26 +5482,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -3689,26 +5519,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3716,28 +5554,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user",
-      "user_id",
-      "query",
-      "filename",
-      "requested_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "query",
+      "filename",
+      "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3745,26 +5591,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3772,18 +5626,28 @@
     "description": "The cache retention policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3795,18 +5659,28 @@
     "description": "The cache storage policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3818,20 +5692,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -3840,16 +5725,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -3860,18 +5758,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -3880,18 +5791,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -3900,18 +5823,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -3920,18 +5856,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -3941,20 +5889,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -3962,17 +5921,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -3982,20 +5954,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -4004,20 +5987,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -4026,17 +6023,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4047,20 +6059,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -4069,19 +6095,31 @@
     "description": "A new passkey was added.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4089,19 +6127,31 @@
     "description": "A new passkey was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4109,18 +6159,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4128,35 +6190,61 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "payment_method.update",
-    "description": "An existing payment method was updated.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "payment_method.update",
+    "description": "An existing payment method was updated.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4164,18 +6252,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4186,18 +6287,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4208,17 +6322,30 @@
     "description": "Triggered when you create a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4228,19 +6355,31 @@
     "description": "Triggered when you regenerate a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4248,12 +6387,29 @@
     "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
     "fields": [
-      "user_programmatic_access_name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
       "operation_type"
     ],
@@ -4264,20 +6420,32 @@
     "description": "Triggered when you delete a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "explanation",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4285,17 +6453,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -4306,18 +6487,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -4329,17 +6523,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -4351,17 +6558,30 @@
     "description": "A fine-grained personal access token was updated.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4372,15 +6592,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4390,17 +6625,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4410,15 +6656,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4428,17 +6689,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4448,17 +6720,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4468,17 +6751,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4488,17 +6782,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4508,17 +6813,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -4528,38 +6846,62 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "@timestamp"
-    ]
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "project.close",
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -4569,25 +6911,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -4595,20 +6949,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4616,25 +6982,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4642,17 +7020,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4660,17 +7051,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4678,18 +7082,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -4698,18 +7114,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -4718,19 +7146,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -4738,17 +7177,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -4760,22 +7212,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -4783,19 +7244,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4803,17 +7275,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4821,18 +7306,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -4840,20 +7338,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4861,18 +7369,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -4881,18 +7401,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -4901,16 +7433,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -4922,21 +7467,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
+      "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -4944,18 +7501,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4966,23 +7536,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -4991,24 +7572,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -5017,20 +7609,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -5039,21 +7645,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -5063,22 +7682,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -5087,25 +7718,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -5114,23 +7755,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -5139,22 +7791,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -5163,21 +7825,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -5186,25 +7857,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -5213,23 +7891,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -5238,24 +7924,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -5264,23 +7957,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -5290,22 +7991,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -5314,19 +8024,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -5335,24 +8058,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -5361,23 +8094,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -5388,17 +8130,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -5407,15 +8162,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -5426,16 +8194,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -5445,17 +8226,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -5465,19 +8259,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -5486,17 +8291,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -5505,26 +8323,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -5533,30 +8357,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -5566,20 +8395,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5588,25 +8428,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5615,23 +8463,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5639,25 +8498,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -5667,23 +8535,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -5691,21 +8569,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5713,21 +8601,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -5735,22 +8633,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5758,65 +8665,95 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
-      "actor",
-      "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
-      "repo",
       "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "repo.pages_private",
-    "description": "A GitHub Pages site visibility was changed to private.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id"
+      "visibility",
+      "operation_type"
     ]
   },
   {
-    "action": "repo.pages_public",
-    "description": "A GitHub Pages site visibility was changed to public.",
+    "action": "repo.pages_private",
+    "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "repo.pages_public",
+    "description": "A GitHub Pages site visibility was changed to public.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5824,18 +8761,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5843,22 +8794,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5866,21 +8827,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5888,18 +8859,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -5908,22 +8891,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5932,24 +8924,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5958,23 +8958,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5982,26 +8992,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -6010,21 +9025,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -6033,25 +9057,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -6059,22 +9089,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -6083,19 +9123,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6103,22 +9154,30 @@
     "description": "The cache retention policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -6130,22 +9189,30 @@
     "description": "The cache storage policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -6157,46 +9224,66 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "public_repo"
-    ],
-    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
-  },
-  {
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
+      "created_at",
+      "operation_type",
+      "public_repo"
+    ],
+    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
+  },
+  {
     "action": "repo.set_actions_private_fork_pr_approvals_policy",
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -6207,21 +9294,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -6230,22 +9328,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -6254,21 +9362,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -6277,22 +9396,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -6303,16 +9432,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -6321,22 +9461,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -6346,22 +9495,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -6370,23 +9530,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -6396,19 +9566,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -6416,21 +9596,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -6439,24 +9629,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -6464,25 +9663,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -6491,24 +9697,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6517,25 +9733,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -6544,22 +9768,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6568,26 +9801,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -6595,31 +9836,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "created_at",
-      "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
-      "operation_type",
-      "request_id",
-      "org_id",
       "actor_id",
-      "visibility",
-      "old_permission",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_id",
-      "old_base_role",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "visibility",
+      "old_permission",
+      "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6628,21 +9876,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -6650,21 +9908,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6672,21 +9940,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -6694,20 +9973,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6715,21 +10006,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6737,19 +10039,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -6757,31 +10072,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -6790,19 +10113,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -6810,8 +10144,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -6820,23 +10153,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -6861,18 +10203,30 @@
     "description": "A security key was registered for an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6880,18 +10234,30 @@
     "description": "A security key was removed from an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6899,14 +10265,28 @@
     "description": "A user linked a social identity to their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6916,14 +10296,28 @@
     "description": "A user unlinked a social identity from their account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6933,15 +10327,28 @@
     "description": "A user unlinked all social identities from their account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6951,16 +10358,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6970,18 +10390,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -6990,16 +10423,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -7010,15 +10456,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -7028,16 +10487,31 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
-      "user_id",
-      "@timestamp"
-    ],
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
   {
@@ -7045,17 +10519,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -7064,17 +10551,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -7083,16 +10584,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -7102,14 +10616,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -7119,17 +10648,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -7138,17 +10680,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -7157,18 +10712,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7177,15 +10745,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -7195,16 +10777,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7212,15 +10807,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -7231,16 +10839,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -7250,17 +10871,30 @@
     "description": "Triggered when you send an email update to your sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
     "fields": [
-      "request_id",
-      "actor",
-      "action",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
   },
@@ -7269,17 +10903,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -7290,17 +10937,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -7311,18 +10971,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -7332,16 +11003,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -7351,17 +11035,30 @@
     "description": "You join the waitlist to join GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "actor_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -7370,16 +11067,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -7389,23 +11099,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7413,23 +11133,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
+      "public_repo",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7437,23 +11167,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7461,23 +11201,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7485,15 +11235,30 @@
     "description": "Triggered when you accept a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7502,15 +11267,30 @@
     "description": "Triggered when you cancel a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7519,15 +11299,30 @@
     "description": "Triggered when you create a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7536,15 +11331,30 @@
     "description": "Triggered when you decline a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7553,15 +11363,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7569,15 +11394,30 @@
     "description": "Triggered when you revoke a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7586,17 +11426,30 @@
     "description": "A new trusted device was added.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7604,17 +11457,30 @@
     "description": "A trusted device was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7622,14 +11488,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "action",
-      "request_id",
-      "user_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -7638,15 +11519,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "created_at",
-      "user_id",
-      "operation_type",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7654,13 +11550,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "created_at",
-      "user_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7668,17 +11581,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "operation_type",
-      "action",
-      "_document_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7686,17 +11612,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7704,16 +11643,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7721,15 +11674,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "user",
       "_document_id",
-      "request_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7737,18 +11705,30 @@
     "description": "A secondary authentication factor was added to a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -7757,18 +11737,30 @@
     "description": "Two-factor authentication was disabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
     "fields": [
-      "actor",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_id",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Disabling two-factor authentication for your personal account"
   },
@@ -7777,18 +11769,30 @@
     "description": "Two-factor authentication was enabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
-      "actor",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Configuring two-factor authentication"
   },
@@ -7797,15 +11801,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user",
-      "user_id",
-      "action",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "user_agent"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7813,16 +11832,29 @@
     "description": "Two factor recovery codes were regenerated for a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
+      "operation_type",
       "created_at"
     ]
   },
@@ -7831,18 +11863,30 @@
     "description": "A secondary authentication factor was removed from a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -7851,15 +11895,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "created_at",
-      "_document_id",
-      "action",
-      "@timestamp"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7868,16 +11927,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "operation_type",
       "user_agent",
-      "action",
-      "request_id",
-      "actor",
-      "actor_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7885,19 +11957,31 @@
     "description": "An email address was added to a user account.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "actor_id",
-      "actor",
       "email",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding an email address to your GitHub account"
   },
@@ -7906,18 +11990,30 @@
     "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "created_at",
-      "user",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7925,15 +12021,28 @@
     "description": "Audit log entries were exported.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "action",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ]
@@ -7943,20 +12052,31 @@
     "description": "A user was blocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_id",
-      "_document_id",
       "actor_id",
-      "@timestamp",
-      "user_agent",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7964,18 +12084,30 @@
     "description": "A user changed their password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "actor_id",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7983,18 +12115,30 @@
     "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -8003,17 +12147,30 @@
     "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -8022,19 +12179,31 @@
     "description": "A new user account was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "email",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "created_at",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "programmatic_access_type"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "email",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8042,21 +12211,33 @@
     "description": "A user secret for Codespaces was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8064,20 +12245,31 @@
     "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "oauth_application_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "@timestamp",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -8085,18 +12277,30 @@
     "description": "A user account was destroyed by an asynchronous job.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8105,19 +12309,30 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "oauth_application_id",
+      "_document_id",
       "action",
-      "user",
-      "created_at",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8125,18 +12340,30 @@
     "description": "A user deleted his or her account, triggering user.async_delete.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
-      "created_at",
-      "user_agent",
       "user_id",
-      "operation_type",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8144,37 +12371,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "user_agent",
-      "user_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "operation_type",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "user.device_verification_requested",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
-      "operation_type",
+      "user_agent",
       "created_at",
-      "_document_id",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "user.device_verification_requested",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "user",
-      "actor_id",
+      "_document_id",
       "action",
-      "request_access_security_header"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8183,17 +12434,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "request_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8201,17 +12464,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8219,17 +12495,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8237,17 +12526,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8255,21 +12557,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8277,21 +12589,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -8300,17 +12622,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8318,17 +12653,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8336,17 +12684,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8354,18 +12715,30 @@
     "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "org_id",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8373,17 +12746,31 @@
     "description": "A user requested a password reset.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
     "fields": [
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "email",
-      "created_at",
-      "user_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
   },
@@ -8392,17 +12779,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "created_at",
-      "user_agent",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "request_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8410,18 +12810,30 @@
     "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -8430,19 +12842,31 @@
     "description": "A user signed in.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "actor_id",
       "@timestamp",
-      "user",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "actor",
-      "passkey_nickname",
-      "request_access_security_header"
+      "passkey_nickname"
     ]
   },
   {
@@ -8450,18 +12874,30 @@
     "description": "A user signed out.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8469,18 +12905,30 @@
     "description": "A user signed in from a new device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8488,21 +12936,31 @@
     "description": "An ordinary user account was promoted to a site administrator.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
+      "user_id",
       "user_agent",
+      "created_at",
       "oauth_application_id",
-      "request_id",
-      "operation_type",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8510,16 +12968,29 @@
     "description": "A user's account was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user",
-      "action",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "operation_type"
     ]
   },
@@ -8528,20 +12999,31 @@
     "description": "An email address was removed from a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "actor_id",
       "created_at",
-      "email",
-      "token_scopes",
-      "programmatic_access_type"
+      "email"
     ]
   },
   {
@@ -8549,20 +13031,32 @@
     "description": "A user secret for Codespaces was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "key",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8570,20 +13064,31 @@
     "description": "A username was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "request_id",
-      "actor_id",
-      "old_login",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_login",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8591,18 +13096,30 @@
     "description": "A user reset their account password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8610,16 +13127,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -8630,16 +13160,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -8648,18 +13190,30 @@
     "description": "A user signed in from an unrecognized device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor",
-      "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8667,18 +13221,30 @@
     "description": "A user signed in from an unrecognized device and location.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "created_at",
-      "_document_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8686,22 +13252,33 @@
     "description": "Triggered when you clear the status on your profile.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "message",
-      "user",
-      "actor_id",
       "created_at",
-      "request_id",
       "limited_availability",
-      "action",
       "emoji",
-      "operation_type",
-      "user_agent",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8709,23 +13286,33 @@
     "description": "Triggered when you set or change the status on your profile.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
     "fields": [
-      "limited_availability",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "message",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "emoji",
-      "org",
-      "actor",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "limited_availability",
+      "message",
+      "created_at",
+      "emoji",
+      "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
   },
@@ -8734,21 +13321,31 @@
     "description": "A user account was suspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "user_agent",
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "token_scopes",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8756,18 +13353,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
-      "actor_id",
       "@timestamp",
-      "operation_type",
       "_document_id",
-      "user_agent",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8775,18 +13384,30 @@
     "description": "A 2FA challenge issued for a user account failed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "actor_id",
-      "actor",
-      "user_id",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8796,16 +13417,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
       "user_agent",
-      "request_id",
-      "action",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8813,18 +13446,30 @@
     "description": "A user used their 2FA recovery codes.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8832,18 +13477,30 @@
     "description": "A user downloaded 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8851,17 +13508,30 @@
     "description": "A user printed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8869,18 +13539,30 @@
     "description": "A user viewed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
       "created_at",
-      "user",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8888,17 +13570,30 @@
     "description": "A user was prompted for a two-factor authentication code.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
     "fields": [
-      "user",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "actor"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
   },
@@ -8907,19 +13602,31 @@
     "description": "A user was unblocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "user_agent",
-      "user_id",
-      "user",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8927,21 +13634,31 @@
     "description": "A user account was unsuspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "user_agent",
       "actor",
-      "oauth_application_id",
-      "operation_type",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "user_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8949,21 +13666,33 @@
     "description": "A user secret for Codespaces was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8971,46 +13700,64 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "workflows.approve_workflow_job",
+    "description": "A workflow job was approved.",
+    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "workflows.approve_workflow_job",
-    "description": "A workflow job was approved.",
-    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
-    "fields": [
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "workflow_run_id",
       "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -9019,23 +13766,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9043,23 +13800,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9069,23 +13834,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -9094,22 +13871,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9117,21 +13905,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -9139,25 +13938,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9165,24 +13972,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -9191,25 +14007,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.14/enterprise.json b/src/audit-logs/data/ghes-3.14/enterprise.json
index 52f857ef967f..b49112ba6e3d 100644
--- a/src/audit-logs/data/ghes-3.14/enterprise.json
+++ b/src/audit-logs/data/ghes-3.14/enterprise.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,17 +67,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
-      "user_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -61,18 +98,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
+      "token_scopes",
       "user",
-      "request_id",
-      "_document_id",
-      "user_agent",
-      "actor",
       "user_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -80,18 +129,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "token_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -99,29 +160,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -129,31 +196,34 @@
     "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "query_string",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "request_body",
-      "status_code",
-      "url_path",
       "business",
       "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "request_method",
+      "query_string",
+      "request_body",
+      "status_code",
+      "url_path",
+      "public_repo",
       "created_at",
       "operation_type",
       "route",
@@ -167,18 +237,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -186,20 +268,32 @@
     "description": "A manual check of the endpoint configured for audit log streaming was performed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "audit_log_stream_result",
-      "business_id",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_result",
       "created_at",
       "operation_type",
-      "audit_log_stream_sink_details",
-      "request_access_security_header"
+      "audit_log_stream_sink_details"
     ]
   },
   {
@@ -207,18 +301,31 @@
     "description": "An endpoint was added for audit log streaming.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "business_id",
       "business",
-      "audit_log_stream_sink",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_sink",
+      "created_at",
+      "operation_type",
       "audit_log_stream_id"
     ]
   },
@@ -227,15 +334,28 @@
     "description": "An audit log streaming endpoint was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "business_id",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "audit_log_stream_id",
@@ -247,17 +367,30 @@
     "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "audit_log_stream_enabled",
-      "business_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_enabled",
       "audit_log_stream_sink",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "new_s3_bucket",
@@ -280,17 +413,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -299,19 +445,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -320,18 +478,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -339,18 +510,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -358,15 +541,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -376,22 +572,31 @@
     "description": "An enterprise owner was added to an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
     "fields": [
-      "name",
-      "business",
-      "user",
-      "user_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "request_id",
+      "business",
       "business_id",
-      "_document_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Inviting people to manage your enterprise"
   },
@@ -400,22 +605,32 @@
     "description": "An organization was added to an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "operation_type",
       "name",
       "created_at",
-      "request_id",
-      "_document_id",
-      "business",
-      "organization_upgrade",
-      "request_access_security_header"
+      "organization_upgrade"
     ]
   },
   {
@@ -423,20 +638,30 @@
     "description": "GitHub Advanced Security was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -445,17 +670,28 @@
     "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -466,21 +702,31 @@
     "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -489,17 +735,28 @@
     "description": "GitHub Advanced Security was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -510,17 +767,28 @@
     "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -531,21 +799,31 @@
     "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -554,20 +832,32 @@
     "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "new_policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "new_policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -576,20 +866,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -597,17 +899,28 @@
     "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -619,21 +932,31 @@
     "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -642,18 +965,31 @@
     "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -662,17 +998,30 @@
     "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
     "fields": [
-      "name",
-      "operation_type",
-      "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "actor",
+      "@timestamp",
       "_document_id",
-      "business",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -682,19 +1031,32 @@
     "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
-      "action",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "business",
       "visibility",
       "created_at",
-      "actor",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -703,21 +1065,33 @@
     "description": "The policy for Code scanning autofix was updated for an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -725,19 +1099,31 @@
     "description": "An enterprise was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "request_id",
-      "name",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "operation_type",
-      "actor",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -745,17 +1131,28 @@
     "description": "Dependabot alerts were disabled for new repositories in your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -765,17 +1162,28 @@
     "description": "Dependabot alerts were enabled for new repositories in your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -785,17 +1193,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -805,18 +1226,30 @@
     "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -824,17 +1257,28 @@
     "description": "Display of IP addresses within audit log events for the enterprise was disabled.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -845,18 +1289,31 @@
     "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "business_id",
-      "actor_id",
-      "name",
-      "_document_id",
-      "request_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ]
   },
   {
@@ -864,15 +1321,28 @@
     "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -882,17 +1352,28 @@
     "description": "Display of IP addresses within audit log events for the enterprise was enabled.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -903,18 +1384,31 @@
     "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "operation_type",
-      "created_at",
+      "actor_id",
       "business",
       "business_id",
-      "name",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ]
   },
   {
@@ -922,20 +1416,31 @@
     "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
       "business",
-      "name",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "business_id",
-      "_document_id"
+      "created_at",
+      "name",
+      "operation_type"
     ]
   },
   {
@@ -943,20 +1448,31 @@
     "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -964,20 +1480,31 @@
     "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "business",
-      "actor_id",
-      "created_at",
-      "action",
+      "user_id",
       "user_agent",
-      "request_id",
-      "user_id"
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -985,20 +1512,31 @@
     "description": "An enterprise owner was removed from an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
-      "user_agent",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "name",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
-      "user"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ],
     "docs_reference_titles": "Inviting people to manage your enterprise"
   },
@@ -1007,20 +1545,31 @@
     "description": "An organization was removed from an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "business",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "business_id",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "name",
-      "org"
+      "name"
     ]
   },
   {
@@ -1028,18 +1577,31 @@
     "description": "The slug for the enterprise URL was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "name",
-      "business_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
-      "@timestamp",
-      "created_at",
+      "actor_id",
       "business",
-      "_document_id"
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1047,20 +1609,31 @@
     "description": "The SAML single sign-on session for a member in an enterprise was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "_document_id",
-      "actor_id",
       "name",
-      "@timestamp",
-      "user_id",
-      "action",
-      "created_at",
-      "business"
+      "created_at"
     ]
   },
   {
@@ -1068,17 +1641,28 @@
     "description": "Automatic partner validation checks have been disabled at the business level",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1089,17 +1673,28 @@
     "description": "Automatic partner validation checks have been enabled at the business level",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1110,20 +1705,30 @@
     "description": "An enterprise-level custom pattern was created for secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -1132,17 +1737,28 @@
     "description": "An enterprise-level custom pattern was removed from secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1152,20 +1768,30 @@
     "description": "An enterprise-level custom pattern was published for secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1173,17 +1799,28 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1194,20 +1831,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -1216,17 +1863,28 @@
     "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1236,17 +1894,28 @@
     "description": "Secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1257,17 +1926,28 @@
     "description": "Secret scanning was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1278,17 +1958,28 @@
     "description": "Secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1299,17 +1990,28 @@
     "description": "Secret scanning was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1320,17 +2022,28 @@
     "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1342,17 +2055,28 @@
     "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1364,17 +2088,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1385,17 +2120,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1406,17 +2152,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1427,17 +2184,28 @@
     "description": "Push protection for secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1448,17 +2216,28 @@
     "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1469,17 +2248,28 @@
     "description": "Push protection for secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1490,17 +2280,28 @@
     "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1511,20 +2312,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1532,17 +2345,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -1553,20 +2379,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1575,19 +2413,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1596,19 +2447,31 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1617,20 +2480,32 @@
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1639,19 +2514,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1660,20 +2547,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "issuer",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
       "business_id",
-      "actor_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "issuer",
+      "name",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1681,46 +2580,72 @@
     "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "updated_github_owned_allowed",
-      "updated_verified_allowed",
-      "updated_patterns",
-      "new_policy",
-      "old_policy",
-      "updated_access_policy"
-    ],
-    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
-  },
-  {
-    "action": "business.update_default_repository_permission",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "updated_github_owned_allowed",
+      "updated_verified_allowed",
+      "updated_patterns",
+      "new_policy",
+      "old_policy",
+      "updated_access_policy"
+    ],
+    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+  },
+  {
+    "action": "business.update_default_repository_permission",
     "description": "The base repository permission setting was updated for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
     "fields": [
-      "business_id",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "permission",
-      "action",
       "created_at",
-      "@timestamp",
-      "request_id",
       "name",
-      "_document_id",
-      "old_permission",
-      "business"
+      "old_permission"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -1729,19 +2654,32 @@
     "description": "The repository creation setting was updated for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "name",
-      "business_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "operation_type",
-      "permission",
-      "action",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "name",
+      "operation_type",
+      "permission",
       "visibility"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -1751,19 +2689,32 @@
     "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories",
     "fields": [
-      "business_id",
-      "created_at",
-      "action",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "permission",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "business"
+      "created_at",
+      "operation_type",
+      "permission",
+      "name"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -1772,20 +2723,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -1794,20 +2756,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -1818,17 +2791,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1836,14 +2821,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1853,25 +2853,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -1882,22 +2891,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
-      "repository",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -1909,22 +2929,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -1933,15 +2964,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -1952,17 +2998,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1972,27 +3031,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "org",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2000,19 +3068,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -2020,18 +3101,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -2040,23 +3133,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2064,16 +3164,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -2082,40 +3196,59 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "request_access_security_header"
-    ]
-  },
-  {
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
     "action": "copilot.cfb_seat_assignment_reused",
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2125,20 +3258,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2146,19 +3289,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -2166,21 +3321,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -2188,21 +3352,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2212,19 +3385,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2234,21 +3416,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2258,18 +3449,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -2282,18 +3486,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -2307,14 +3524,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -2327,8 +3559,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2337,27 +3568,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2366,19 +3605,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2387,16 +3638,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "definition_id"
@@ -2408,19 +3672,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -2429,19 +3704,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -2450,19 +3736,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -2471,19 +3768,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -2492,17 +3800,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2510,40 +3831,62 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
-  },
-  {
-    "action": "dependabot_security_updates.enable",
-    "description": "Dependabot security updates were enabled for all existing repositories.",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+  },
+  {
+    "action": "dependabot_security_updates.enable",
+    "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2551,19 +3894,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -2572,19 +3926,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2592,19 +3957,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -2613,19 +3989,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2633,19 +4020,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -2654,20 +4052,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2675,21 +4083,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "team",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "number",
-      "org",
-      "title",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id"
+      "team",
+      "created_at",
+      "number",
+      "title",
+      "operation_type"
     ]
   },
   {
@@ -2697,18 +4117,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user_id",
-      "actor",
       "number",
-      "user",
-      "created_at",
-      "request_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2716,18 +4149,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "_document_id",
-      "request_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "number",
       "team",
       "created_at"
@@ -2738,21 +4182,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "_document_id",
-      "title",
-      "user",
-      "user_agent",
-      "org",
-      "operation_type",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "team",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type",
+      "team",
       "number"
     ]
   },
@@ -2761,17 +4216,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2782,16 +4251,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2802,18 +4285,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
       "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2824,23 +4321,31 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise"
   },
@@ -2849,19 +4354,33 @@
     "description": "A domain was approved for an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -2870,18 +4389,33 @@
     "description": "A domain was added to an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -2890,18 +4424,33 @@
     "description": "A domain was removed from an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -2910,18 +4459,33 @@
     "description": "A domain was verified for an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -2930,18 +4494,30 @@
     "description": "A new GitHub Actions self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -2950,20 +4526,30 @@
     "description": "A GitHub Actions self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -2972,18 +4558,31 @@
     "description": "A GitHub Actions self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
@@ -2993,18 +4592,31 @@
     "description": "A GitHub Actions self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3013,20 +4625,33 @@
     "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -3035,19 +4660,31 @@
     "description": "A GitHub Actions self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3056,19 +4693,32 @@
     "description": "A GitHub Actions runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -3077,24 +4727,36 @@
     "description": "The configuration of a GitHub Actions self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3103,14 +4765,32 @@
     "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -3119,14 +4799,32 @@
     "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -3135,18 +4833,36 @@
     "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
       "target_version",
       "runner_group_id",
       "runner_group_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Self-hosted runners"
   },
@@ -3155,22 +4871,32 @@
     "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "business_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "user",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3178,21 +4904,33 @@
     "description": "A license for GitHub Copilot was assigned to an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3200,17 +4938,30 @@
     "description": "A license for GitHub Copilot was unassigned from an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "business_id",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3221,17 +4972,30 @@
     "description": "A new enterprise team was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3241,17 +5005,30 @@
     "description": "An enterprise team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3262,22 +5039,32 @@
     "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "business_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "user",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3285,18 +5072,31 @@
     "description": "The name of an enterprise team was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "business_id",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3307,22 +5107,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3331,22 +5140,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3354,28 +5173,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3384,27 +5209,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -3413,25 +5246,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3440,26 +5281,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3468,21 +5316,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -3491,22 +5351,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3515,25 +5385,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3542,22 +5421,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -3566,21 +5457,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -3591,27 +5492,33 @@
     "description": "A user was added to an external group.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "external_group",
-      "external_group_id",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "external_group",
+      "external_group_id",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -3619,19 +5526,31 @@
     "description": "An external group was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at",
       "scim_group_id"
     ]
   },
@@ -3640,22 +5559,33 @@
     "description": "An external group was linked to a GitHub team.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "external_group",
-      "programmatic_access_type",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -3663,21 +5593,31 @@
     "description": "An external group was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3685,26 +5625,32 @@
     "description": "A user was removed from an external group.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "external_group",
-      "external_group_id",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "external_group",
+      "external_group_id",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3712,15 +5658,29 @@
     "description": "Failed external group SCIM API request.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
@@ -3728,15 +5688,9 @@
       "url_path",
       "scim_group_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -3745,30 +5699,38 @@
     "description": "Successful external group SCIM API request. Excludes GET API requests.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -3777,18 +5739,31 @@
     "description": "An external group was unlinked to a GitHub team.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "external_group"
     ]
   },
@@ -3797,22 +5772,32 @@
     "description": "An external group was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "scim_group_id",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at",
+      "scim_group_id"
     ]
   },
   {
@@ -3820,25 +5805,33 @@
     "description": "An external group's display name was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
       "external_group",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -3846,20 +5839,31 @@
     "description": "An external identity was deprovisioned, suspending the linked GitHub user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "token_scopes",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3867,17 +5871,31 @@
     "description": "An external identity was created and linked to a GitHub user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "scim_user_id",
-      "request_access_security_header"
+      "scim_user_id"
     ]
   },
   {
@@ -3885,15 +5903,29 @@
     "description": "Failed external identity SCIM API request.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
@@ -3901,15 +5933,9 @@
       "url_path",
       "scim_user_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -3918,30 +5944,38 @@
     "description": "Successful external identity SCIM API request. Excludes GET API requests.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -3950,18 +5984,31 @@
     "description": "An external identity was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "scim_user_id",
-      "request_access_security_header"
+      "scim_user_id"
     ]
   },
   {
@@ -3969,21 +6016,32 @@
     "description": "A gist was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "gist_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "visibility",
-      "action",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ]
   },
   {
@@ -3991,20 +6049,32 @@
     "description": "A gist was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "gist_id",
-      "visibility",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "user",
-      "request_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "programmatic_access_type"
+      "gist_id",
+      "visibility",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4012,21 +6082,32 @@
     "description": "The visibility of a gist was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "user",
-      "gist_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "visibility",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "gist_id",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -4034,19 +6115,30 @@
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4055,20 +6147,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4077,19 +6179,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4098,22 +6211,33 @@
     "description": "An SSH key was added to a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -4122,23 +6246,34 @@
     "description": "An SSH key was removed from a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
       "explanation",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -4147,23 +6282,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4171,18 +6315,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4193,20 +6347,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -4216,18 +6380,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "user",
-      "operation_type",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4235,18 +6411,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4254,25 +6442,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -4280,25 +6478,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -4306,26 +6513,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -4334,25 +6550,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -4360,26 +6585,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -4387,21 +6621,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -4410,19 +6655,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -4430,21 +6688,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -4453,19 +6722,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -4476,20 +6759,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
-      "integration",
-      "user_id",
-      "user",
-      "action",
+      "integration",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -4499,24 +6794,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -4527,23 +6833,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -4554,20 +6872,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -4577,19 +6908,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -4598,20 +6943,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -4621,20 +6979,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -4643,20 +7014,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -4665,40 +7049,65 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "integration.revoke_all_tokens",
+    "description": "All user tokens for a GitHub App were requested to be revoked.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "integration.revoke_all_tokens",
-    "description": "All user tokens for a GitHub App were requested to be revoked.",
-    "docs_reference_links": "N/A",
-    "fields": [
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "name",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -4707,19 +7116,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -4728,17 +7150,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -4751,21 +7186,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -4779,17 +7227,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -4801,19 +7262,30 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "user"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4821,19 +7293,30 @@
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4841,17 +7324,28 @@
     "description": "IP allow list user level enforcement was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4861,20 +7355,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "user_id",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
-      "_document_id",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "actor_id",
       "operation_type",
-      "org",
       "created_at"
     ]
   },
@@ -4883,19 +7386,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4903,17 +7417,28 @@
     "description": "IP allow list user level enforcement was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4923,24 +7448,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4948,24 +7481,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "ip_allow_list_entry",
-      "org",
-      "operation_type",
-      "created_at",
-      "active",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at",
+      "active"
     ]
   },
   {
@@ -4973,19 +7514,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "actor_id",
       "ip_allow_list_entry",
-      "active",
-      "org_id",
-      "@timestamp"
+      "active"
     ]
   },
   {
@@ -4993,18 +7547,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5012,21 +7578,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -5034,21 +7613,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5056,22 +7648,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -5079,19 +7684,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "org_id",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -5102,21 +7720,36 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
       "marketplace_listing",
       "has_free_trial",
-      "user_agent",
-      "request_id",
-      "actor_id",
       "yearly_price_in_cents",
       "description",
       "bullets",
       "monthly_price_in_cents",
-      "marketplace_listing_plan",
-      "_document_id"
+      "marketplace_listing_plan"
     ]
   },
   {
@@ -5124,22 +7757,37 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "marketplace_listing_plan",
       "marketplace_listing",
       "description",
       "bullets",
       "has_free_trial",
       "created_at",
-      "actor_id",
       "operation_type",
-      "_document_id",
-      "action",
-      "user_agent",
-      "request_id",
-      "actor",
       "monthly_price_in_cents",
-      "yearly_price_in_cents",
-      "@timestamp"
+      "yearly_price_in_cents"
     ]
   },
   {
@@ -5147,21 +7795,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "marketplace_listing_plan",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "marketplace_listing_plan",
       "description",
       "yearly_price_in_cents",
-      "@timestamp",
       "created_at",
-      "actor_id",
       "bullets",
       "has_free_trial",
       "marketplace_listing",
-      "user_agent",
       "monthly_price_in_cents",
-      "action",
       "operation_type"
     ]
   },
@@ -5170,21 +7833,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "monthly_price_in_cents",
-      "marketplace_listing",
+      "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "monthly_price_in_cents",
+      "marketplace_listing",
       "description",
       "bullets",
       "yearly_price_in_cents",
-      "request_id",
-      "actor_id",
       "has_free_trial",
       "marketplace_listing_plan",
-      "user_agent",
-      "@timestamp",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -5193,22 +7871,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -5216,22 +7907,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5239,19 +7943,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5259,21 +7975,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5283,16 +8008,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5302,18 +8040,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5323,14 +8074,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5338,19 +8105,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -5358,18 +8136,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5377,23 +8167,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -5401,20 +8199,30 @@
     "description": "An OAuth access token was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
     "fields": [
-      "_document_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "user",
-      "user_id",
-      "created_at",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "request_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
@@ -5425,19 +8233,30 @@
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "explanation",
-      "hashed_token",
-      "actor_id",
-      "token_scopes",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
@@ -5447,19 +8266,30 @@
     "description": "An OAuth access token was regenerated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "_document_id",
-      "created_at",
       "@timestamp",
-      "operation_type",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ]
   },
@@ -5468,18 +8298,30 @@
     "description": "An OAuth access token was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5487,20 +8329,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5509,20 +8363,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5531,20 +8397,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5553,20 +8431,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5575,19 +8465,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5596,20 +8499,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5618,20 +8533,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5641,18 +8568,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "org_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "oauth_application_id",
-      "action",
       "created_at",
-      "actor",
-      "actor_id",
-      "oauth_application",
-      "_document_id",
-      "request_id"
+      "oauth_application"
     ]
   },
   {
@@ -5660,36 +8600,66 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
       "oauth_application",
-      "actor_id",
-      "oauth_application_id",
+      "oauth_application_id"
+    ],
+    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+  },
+  {
+    "action": "oauth_application.unsuspend",
+    "description": "An OAuth application was unsuspended for a user or organization account.",
+    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+    "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
-    ],
-    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
-  },
-  {
-    "action": "oauth_application.unsuspend",
-    "description": "An OAuth application was unsuspended for a user or organization account.",
-    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
-    "fields": [
+      "user_id",
+      "user_agent",
       "operation_type",
-      "org_id",
-      "action",
       "oauth_application_id",
       "oauth_application",
-      "org",
-      "created_at",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5698,24 +8668,31 @@
     "description": "An authorization for an OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "user_id",
-      "actor",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
       "actor_id",
-      "user",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "actor_is_bot",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -5725,20 +8702,31 @@
     "description": "An authorization for an OAuth application was deleted.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "actor",
       "created_at",
       "explanation",
-      "user",
-      "user_id",
-      "org_id",
-      "action",
-      "actor_id",
-      "token_scopes",
       "actor_is_bot",
       "oauth_application_name"
     ],
@@ -5749,20 +8737,31 @@
     "description": "An authorization for an OAuth application was updated.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
-      "actor_id",
       "user_agent",
-      "@timestamp",
       "operation_type",
-      "action",
-      "user",
       "created_at",
-      "_document_id",
       "actor_is_bot",
-      "request_access_security_header",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -5772,17 +8771,28 @@
     "description": "An invitation sent to an organization to join an enterprise was accepted.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5793,20 +8803,30 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
   },
@@ -5815,21 +8835,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -5838,24 +8868,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5863,21 +8903,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -5885,20 +8935,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "org",
-      "org_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5906,22 +8966,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5929,20 +8997,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5950,22 +9028,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5973,19 +9059,30 @@
     "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -5994,19 +9091,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -6016,16 +9124,29 @@
     "description": "A user initiated a background job to delete an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ]
   },
@@ -6034,16 +9155,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -6052,18 +9186,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
-      "actor",
-      "user_agent",
-      "org_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "blocked_user",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -6072,19 +9219,30 @@
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -6094,22 +9252,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "email",
-      "@timestamp",
-      "actor",
-      "action",
       "operation_type",
-      "user_agent",
-      "org",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -6117,19 +9286,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -6137,23 +9317,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6161,21 +9349,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6183,21 +9381,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -6206,21 +9413,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -6229,16 +9445,29 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
@@ -6248,17 +9477,30 @@
     "description": "The interaction limit for prior contributors only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6267,17 +9509,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6287,16 +9542,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6305,17 +9573,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "_document_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6324,17 +9605,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6343,22 +9637,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -6367,17 +9669,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6388,18 +9701,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
-      "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -6408,18 +9733,30 @@
     "description": "An organization was deleted by a user or staff.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "org_id",
-      "org",
       "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6427,20 +9764,30 @@
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -6449,19 +9796,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -6470,14 +9828,31 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sso_url",
       "issuer",
-      "action",
-      "@timestamp",
-      "_document_id",
       "created_at",
-      "org",
       "operation_type"
     ]
   },
@@ -6486,37 +9861,61 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
     "action": "org.display_commenter_full_name_disabled",
-    "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
+    "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6524,19 +9923,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
-      "action",
-      "actor_id",
-      "org_id"
+      "created_at"
     ]
   },
   {
@@ -6544,19 +9954,30 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -6565,19 +9986,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -6586,19 +10018,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "sso_url",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "issuer",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "sso_url",
+      "created_at",
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -6607,17 +10052,30 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
   },
@@ -6626,17 +10084,30 @@
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -6645,18 +10116,31 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
-      "org",
-      "user_agent",
-      "request_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "manager",
       "operation_type",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6664,23 +10148,32 @@
     "description": "A new user was invited to join an organization.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
     "fields": [
-      "org",
-      "user_id",
-      "invitation_id",
-      "org_id",
-      "user",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -6689,17 +10182,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6709,19 +10213,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6729,19 +10244,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6750,16 +10276,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6767,17 +10306,30 @@
     "description": "An organization was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6785,19 +10337,31 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -6806,18 +10370,29 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
@@ -6827,21 +10402,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6849,21 +10433,30 @@
     "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user",
-      "org_id",
-      "created_at",
-      "request_id",
       "@timestamp",
-      "action",
-      "operation_type",
-      "user_agent",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6871,21 +10464,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -6893,18 +10496,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -6913,19 +10528,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
-      "old_login",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_login",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6933,20 +10560,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -6955,21 +10592,33 @@
     "description": "A self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -6979,21 +10628,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7002,23 +10661,33 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -7027,23 +10696,31 @@
     "description": "A self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7052,19 +10729,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -7073,25 +10763,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7100,21 +10801,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7124,21 +10834,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7148,20 +10867,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7170,22 +10899,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7194,21 +10931,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7217,21 +10963,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7240,22 +10995,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7264,21 +11027,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7287,21 +11059,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7311,21 +11092,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7335,19 +11125,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7357,21 +11158,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7381,21 +11191,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7405,19 +11224,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7427,22 +11257,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7451,22 +11289,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7475,22 +11321,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7499,21 +11353,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7522,21 +11385,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7545,22 +11417,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7569,22 +11449,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7593,15 +11481,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7610,15 +11515,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7627,7 +11549,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -7642,20 +11585,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -7664,16 +11618,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -7684,18 +11651,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -7704,17 +11684,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7722,18 +11715,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -7742,18 +11747,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -7762,18 +11780,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -7782,22 +11812,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issuer",
-      "business",
       "operation_type",
       "created_at",
-      "request_id",
-      "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7805,19 +11845,31 @@
     "description": "A user account was converted into an organization.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization",
     "fields": [
-      "actor",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "@timestamp",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "owner",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "owner"
     ],
     "docs_reference_titles": "Converting a user into an organization"
   },
@@ -7826,19 +11878,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
-      "oauth_application_id",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "blocked_user",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -7847,23 +11912,34 @@
     "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -7872,20 +11948,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -7894,20 +11982,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -7915,17 +12014,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -7935,20 +12047,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "business",
-      "@timestamp"
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -7957,19 +12080,32 @@
     "description": "An organization's SAML provider settings were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "issuer",
-      "org",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -7977,18 +12113,30 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "org",
-      "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
@@ -7997,20 +12145,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "org_id",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -8019,16 +12180,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8037,14 +12213,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -8055,16 +12246,31 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "operation_type",
-      "domain_name",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
       "_document_id",
-      "actor_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "domain_name",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8073,20 +12279,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -8096,23 +12313,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8121,21 +12349,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -8146,21 +12385,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8169,20 +12421,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8191,17 +12457,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8212,20 +12493,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8234,19 +12529,31 @@
     "description": "A new passkey was added.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8254,19 +12561,31 @@
     "description": "A new passkey was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8274,18 +12593,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8293,16 +12624,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8310,18 +12655,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8329,18 +12686,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8351,18 +12721,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8373,17 +12756,30 @@
     "description": "Triggered when you create a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8393,19 +12789,31 @@
     "description": "Triggered when you regenerate a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8413,12 +12821,29 @@
     "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
     "fields": [
-      "user_programmatic_access_name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
       "operation_type"
     ],
@@ -8429,20 +12854,32 @@
     "description": "Triggered when you delete a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "explanation",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8450,17 +12887,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8471,18 +12921,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8494,17 +12957,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8516,17 +12992,30 @@
     "description": "A fine-grained personal access token was updated.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8537,15 +13026,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8555,17 +13059,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8575,15 +13090,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8593,17 +13123,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8613,17 +13154,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8633,17 +13185,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8653,17 +13216,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8673,17 +13247,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -8693,17 +13280,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8711,20 +13311,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -8734,17 +13345,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8752,17 +13376,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "actor_id",
-      "operation_type",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8770,18 +13407,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -8790,18 +13439,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -8810,19 +13471,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -8830,17 +13502,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -8852,22 +13537,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -8875,19 +13569,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8895,17 +13600,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8913,18 +13631,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -8932,20 +13663,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8953,18 +13694,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -8973,18 +13726,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -8993,22 +13758,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -9017,29 +13792,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9047,24 +13827,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "repo_id",
-      "user_id",
       "@timestamp",
-      "user_agent",
-      "repo",
-      "name",
-      "org_id",
-      "user",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -9075,21 +13863,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -9100,22 +13898,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -9123,24 +13931,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "authorized_actors_only",
       "authorized_actors",
       "created_at",
-      "user_agent",
       "name",
-      "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
-      "actor_id",
-      "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -9148,30 +13966,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -9181,28 +14006,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -9213,23 +14046,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -9237,22 +14079,32 @@
     "description": "Branch deletion was enabled or disabled for a protected branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "operation_type",
-      "request_id",
-      "repo",
       "@timestamp",
-      "org_id",
-      "org",
-      "action",
-      "allow_deletions_enforcement_level",
       "_document_id",
-      "created_at",
-      "actor_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_deletions_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -9260,23 +14112,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "actor_id",
-      "name",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo",
-      "operation_type",
-      "request_id",
-      "allow_force_pushes_enforcement_level",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_force_pushes_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -9284,24 +14145,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -9310,22 +14180,32 @@
     "description": "Required linear commit history was enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "operation_type",
       "actor",
-      "linear_history_requirement_enforcement_level",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "linear_history_requirement_enforcement_level",
       "name",
-      "org_id",
-      "repo_id",
-      "org",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -9333,24 +14213,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "lock_allows_fetch_and_merge",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -9359,27 +14248,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -9388,18 +14284,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9410,24 +14319,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -9435,25 +14353,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9461,22 +14386,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -9484,22 +14419,33 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
   },
@@ -9508,22 +14454,32 @@
     "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "required_approving_review_count",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -9531,25 +14487,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
     ]
   },
   {
@@ -9557,22 +14520,32 @@
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
       "action",
       "actor",
       "actor_id",
-      "signature_requirement_enforcement_level",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "programmatic_access_type"
+      "operation_type",
+      "name",
+      "created_at",
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -9580,22 +14553,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "_document_id",
-      "org",
       "@timestamp",
-      "created_at",
-      "repo_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "name",
-      "actor",
-      "repo",
       "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
+      "strict_required_status_checks_policy"
     ]
   },
   {
@@ -9603,23 +14586,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -9628,24 +14622,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -9654,20 +14659,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -9676,21 +14695,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -9700,22 +14732,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -9724,25 +14768,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -9751,23 +14805,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -9776,18 +14841,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -9797,21 +14876,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -9820,19 +14910,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -9843,23 +14946,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -9869,17 +14984,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -9887,19 +15016,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -9907,19 +15049,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -9929,21 +15084,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -9952,27 +15118,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "pull_request_url",
       "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9980,23 +15153,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "created_at",
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -10005,18 +15190,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -10024,19 +15223,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -10046,20 +15257,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
-      "repo",
-      "created_at",
-      "request_id",
-      "comment_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "comment_id",
+      "operation_type"
     ]
   },
   {
@@ -10067,18 +15289,31 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "_document_id",
-      "@timestamp",
-      "comment_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "comment_id"
     ]
   },
   {
@@ -10086,21 +15321,33 @@
     "description": "A review on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -10108,20 +15355,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -10130,19 +15390,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -10152,22 +15426,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -10176,21 +15460,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -10199,25 +15492,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -10226,23 +15526,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -10251,24 +15559,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -10277,23 +15592,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -10303,22 +15626,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -10327,19 +15659,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -10348,24 +15693,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -10374,24 +15729,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -10399,24 +15762,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -10424,23 +15795,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -10451,25 +15831,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -10478,26 +15864,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -10506,25 +15900,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "query_suite",
       "threat_model",
       "languages",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -10534,20 +15937,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "visibility",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -10555,17 +15969,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -10574,15 +16001,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -10593,16 +16033,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -10612,17 +16065,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -10632,19 +16098,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -10653,17 +16130,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -10672,26 +16162,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -10700,30 +16196,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -10733,20 +16234,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -10755,25 +16267,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -10782,23 +16302,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -10806,25 +16337,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -10834,17 +16374,30 @@
     "description": "A repository was archived on disk.",
     "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
-      "repo_id",
-      "actor",
       "action",
-      "user_agent"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository/archiving-repositories"
   },
@@ -10853,23 +16406,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -10879,20 +16441,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "visibility",
-      "repo_id",
-      "created_at",
-      "actor",
-      "action",
-      "@timestamp",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -10900,20 +16473,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
-      "repo_id",
-      "request_id",
-      "action",
-      "_document_id",
       "@timestamp",
-      "actor_id",
-      "created_at",
-      "user",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
       "public_repo"
     ]
   },
@@ -10922,19 +16506,30 @@
     "description": "The repository was unlocked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -10942,20 +16537,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "action",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "operation_type",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "visibility",
-      "actor",
-      "user_id"
+      "visibility"
     ]
   },
   {
@@ -10963,23 +16569,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -10987,21 +16603,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11009,21 +16635,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -11031,22 +16667,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -11054,21 +16699,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
       "visibility",
-      "actor",
-      "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
-      "repo",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11076,20 +16731,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11097,22 +16763,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11120,18 +16795,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11139,22 +16828,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11162,21 +16861,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11184,18 +16893,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -11204,22 +16925,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -11228,24 +16958,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -11254,23 +16992,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11278,26 +17026,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -11306,21 +17059,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -11329,25 +17091,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11355,22 +17123,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -11379,20 +17157,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "visibility",
-      "operation_type",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "@timestamp",
-      "request_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -11400,19 +17189,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11420,17 +17220,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -11439,17 +17254,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -11458,7 +17288,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -11473,23 +17324,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -11499,20 +17359,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11523,21 +17394,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -11546,22 +17428,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -11570,21 +17462,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -11593,22 +17496,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -11619,16 +17532,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -11637,22 +17561,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -11662,22 +17595,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "repo_id",
-      "owner",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -11686,23 +17630,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11712,19 +17666,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -11732,21 +17696,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -11755,24 +17729,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -11780,25 +17763,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -11807,24 +17797,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11833,25 +17833,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -11860,22 +17868,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11884,26 +17901,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11911,31 +17936,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11944,24 +17976,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -11970,24 +18008,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -11996,21 +18040,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -12018,21 +18072,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12040,21 +18104,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -12062,20 +18137,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -12083,21 +18170,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12105,19 +18203,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -12125,31 +18236,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -12158,19 +18277,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -12178,8 +18308,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -12188,23 +18317,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -12229,26 +18367,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -12257,26 +18401,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -12285,23 +18435,30 @@
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12311,23 +18468,30 @@
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12337,24 +18501,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12364,24 +18535,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -12390,24 +18568,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12417,23 +18602,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12443,23 +18635,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -12468,22 +18668,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12491,24 +18699,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -12517,24 +18733,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -12543,19 +18767,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12564,24 +18800,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12590,24 +18834,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12616,19 +18868,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12637,26 +18901,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12665,26 +18934,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12693,18 +18967,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -12713,19 +19000,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -12734,14 +19033,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -12755,22 +19068,32 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
@@ -12779,28 +19102,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -12808,25 +19140,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -12834,14 +19173,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -12858,19 +19211,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -12879,19 +19243,30 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -12900,20 +19275,30 @@
     "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -12922,19 +19307,30 @@
     "description": "Secret scanning was enabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -12943,14 +19339,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -12968,25 +19378,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12995,25 +19413,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -13023,25 +19449,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -13050,18 +19484,30 @@
     "description": "A security key was registered for an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13069,18 +19515,30 @@
     "description": "A security key was removed from an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13088,16 +19546,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -13107,18 +19578,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -13127,16 +19611,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -13147,15 +19644,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -13165,15 +19675,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -13182,17 +19707,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -13201,17 +19739,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -13220,16 +19772,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -13239,14 +19804,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -13256,17 +19836,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -13275,17 +19868,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -13294,18 +19900,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -13314,15 +19933,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -13332,16 +19965,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13349,15 +19995,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -13368,16 +20027,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -13387,17 +20059,30 @@
     "description": "Triggered when you send an email update to your sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
     "fields": [
-      "request_id",
-      "actor",
-      "action",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
   },
@@ -13406,17 +20091,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -13427,17 +20125,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -13448,18 +20159,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -13469,16 +20191,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -13488,17 +20223,30 @@
     "description": "You join the waitlist to join GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "actor_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -13507,16 +20255,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -13528,17 +20289,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -13547,19 +20321,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -13568,21 +20355,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "user",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
       "action",
-      "user_id",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "actor_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -13591,19 +20387,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -13612,20 +20419,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -13633,18 +20454,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -13652,16 +20488,31 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "domain_name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -13669,15 +20520,30 @@
     "description": "Triggered when you accept a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -13686,15 +20552,30 @@
     "description": "Triggered when you cancel a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -13703,15 +20584,30 @@
     "description": "Triggered when you create a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -13720,15 +20616,30 @@
     "description": "Triggered when you decline a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -13737,15 +20648,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -13753,15 +20679,30 @@
     "description": "Triggered when you revoke a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -13770,21 +20711,31 @@
     "description": "A member of an organization was added to a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type",
-      "_document_id",
-      "org",
-      "action",
-      "actor",
-      "programmatic_access_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -13794,22 +20745,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -13818,20 +20778,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -13840,18 +20811,31 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
       "created_at",
       "operation_type",
-      "actor_id",
-      "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
@@ -13861,21 +20845,32 @@
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -13884,21 +20879,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -13907,19 +20912,31 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "team",
       "org_id",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
       "operation_type",
-      "_document_id",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -13928,19 +20945,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
       "business",
-      "action",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13948,19 +20976,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "request_id",
       "actor",
-      "org",
-      "created_at",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13968,18 +21007,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
       "@timestamp",
-      "action",
       "_document_id",
-      "user_agent",
-      "user_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -13988,22 +21038,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -14012,22 +21071,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -14037,21 +21105,31 @@
     "description": "A repository was removed from a team's control.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "org",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -14059,21 +21137,32 @@
     "description": "A team's name was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "user_agent",
-      "created_at",
-      "team",
-      "operation_type",
-      "actor_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -14082,17 +21171,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -14101,19 +21203,30 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -14122,28 +21235,37 @@
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
       "operation_type",
       "created_at",
-      "user_agent",
       "permission",
       "new_repo_permission",
       "new_repo_base_role",
       "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_repo_base_role"
     ]
   },
   {
@@ -14151,17 +21273,30 @@
     "description": "A new trusted device was added.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14169,17 +21304,30 @@
     "description": "A trusted device was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14187,14 +21335,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "action",
-      "request_id",
-      "user_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -14203,15 +21366,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "created_at",
-      "user_id",
-      "operation_type",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14219,13 +21397,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "created_at",
-      "user_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14233,17 +21428,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "operation_type",
-      "action",
-      "_document_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14251,17 +21459,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14269,16 +21490,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14286,15 +21521,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "user",
       "_document_id",
-      "request_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14302,18 +21552,30 @@
     "description": "A secondary authentication factor was added to a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -14322,18 +21584,30 @@
     "description": "Two-factor authentication was disabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
     "fields": [
-      "actor",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_id",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Disabling two-factor authentication for your personal account"
   },
@@ -14342,18 +21616,30 @@
     "description": "Two-factor authentication was enabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
-      "actor",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Configuring two-factor authentication"
   },
@@ -14362,15 +21648,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "@timestamp",
-      "request_id",
-      "_document_id",
-      "user_agent"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14378,16 +21679,29 @@
     "description": "Two factor recovery codes were regenerated for a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
+      "operation_type",
       "created_at"
     ]
   },
@@ -14396,18 +21710,30 @@
     "description": "A secondary authentication factor was removed from a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -14416,15 +21742,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "created_at",
-      "_document_id",
-      "action",
-      "@timestamp"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14433,16 +21774,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "operation_type",
       "user_agent",
-      "action",
-      "request_id",
-      "actor",
-      "actor_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14450,19 +21804,31 @@
     "description": "An email address was added to a user account.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "actor_id",
-      "actor",
       "email",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding an email address to your GitHub account"
   },
@@ -14471,18 +21837,30 @@
     "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "created_at",
-      "user",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14490,15 +21868,28 @@
     "description": "Audit log entries were exported.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "action",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ]
@@ -14508,20 +21899,31 @@
     "description": "A user was blocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_id",
-      "_document_id",
       "actor_id",
-      "@timestamp",
-      "user_agent",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -14529,18 +21931,30 @@
     "description": "A user changed their password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "actor_id",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14548,18 +21962,30 @@
     "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -14568,17 +21994,30 @@
     "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -14587,16 +22026,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
-      "user",
       "action",
-      "operation_type",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14604,16 +22057,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "_document_id",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14621,16 +22088,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user_id",
       "@timestamp",
-      "user",
+      "_document_id",
       "action",
-      "request_access_security_header"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14638,19 +22119,31 @@
     "description": "A new user account was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "email",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "created_at",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "programmatic_access_type"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "email",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14658,21 +22151,33 @@
     "description": "A user secret for Codespaces was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -14680,20 +22185,31 @@
     "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "oauth_application_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "@timestamp",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -14701,18 +22217,30 @@
     "description": "A user account was destroyed by an asynchronous job.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14721,19 +22249,30 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "oauth_application_id",
+      "_document_id",
       "action",
-      "user",
-      "created_at",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14741,18 +22280,30 @@
     "description": "A user deleted his or her account, triggering user.async_delete.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
-      "created_at",
-      "user_agent",
       "user_id",
-      "operation_type",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14760,18 +22311,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "user_agent",
       "user_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14779,18 +22342,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "_document_id",
-      "@timestamp",
-      "user",
-      "actor_id",
-      "action",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -14799,17 +22374,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "request_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14817,17 +22404,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14835,17 +22435,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14853,17 +22466,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14871,21 +22497,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14893,21 +22529,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -14916,17 +22562,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14934,17 +22593,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14952,17 +22624,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14970,18 +22655,30 @@
     "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "org_id",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14989,16 +22686,29 @@
     "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ]
   },
@@ -15007,17 +22717,31 @@
     "description": "A user requested a password reset.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
     "fields": [
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "email",
-      "created_at",
-      "user_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
   },
@@ -15026,17 +22750,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "created_at",
-      "user_agent",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "request_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15044,18 +22781,30 @@
     "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -15064,19 +22813,31 @@
     "description": "A user signed in.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "actor_id",
       "@timestamp",
-      "user",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "actor",
-      "passkey_nickname",
-      "request_access_security_header"
+      "passkey_nickname"
     ]
   },
   {
@@ -15084,18 +22845,30 @@
     "description": "A user signed out.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15103,38 +22876,61 @@
     "description": "A comment made by a user was minimized.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
-      "actor_id",
       "@timestamp",
-      "created_at",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "user.new_device_used",
+    "description": "A user signed in from a new device.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "user.new_device_used",
-    "description": "A user signed in from a new device.",
-    "docs_reference_links": "N/A",
-    "fields": [
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
       "user_agent",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15142,14 +22938,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15157,21 +22969,31 @@
     "description": "An ordinary user account was promoted to a site administrator.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
+      "user_id",
       "user_agent",
+      "created_at",
       "oauth_application_id",
-      "request_id",
-      "operation_type",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15179,16 +23001,29 @@
     "description": "A user's account was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user",
-      "action",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "operation_type"
     ]
   },
@@ -15197,20 +23032,31 @@
     "description": "An email address was removed from a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "actor_id",
       "created_at",
-      "email",
-      "token_scopes",
-      "programmatic_access_type"
+      "email"
     ]
   },
   {
@@ -15218,20 +23064,32 @@
     "description": "A user secret for Codespaces was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "key",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15239,17 +23097,30 @@
     "description": "A user account was no longer flagged as a large scale contributor.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15257,20 +23128,31 @@
     "description": "A username was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "request_id",
-      "actor_id",
-      "old_login",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_login",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15278,17 +23160,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "user_agent",
-      "request_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -15297,18 +23191,30 @@
     "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "action",
       "created_at",
-      "actor",
-      "operation_type",
-      "actor_id",
-      "user_id",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam"
   },
@@ -15317,18 +23223,30 @@
     "description": "A user reset their account password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15336,16 +23254,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -15356,16 +23287,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -15374,18 +23317,30 @@
     "description": "A user signed in from an unrecognized device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor",
-      "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -15393,18 +23348,30 @@
     "description": "A user signed in from an unrecognized device and location.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "created_at",
-      "_document_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15412,18 +23379,30 @@
     "description": "A user signed in from an unrecognized location.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "action",
-      "operation_type",
-      "user_agent",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
       "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15431,22 +23410,33 @@
     "description": "Triggered when you clear the status on your profile.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "message",
-      "user",
-      "actor_id",
       "created_at",
-      "request_id",
       "limited_availability",
-      "action",
       "emoji",
-      "operation_type",
-      "user_agent",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15454,23 +23444,33 @@
     "description": "Triggered when you set or change the status on your profile.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
     "fields": [
-      "limited_availability",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "message",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "limited_availability",
+      "message",
+      "created_at",
       "emoji",
-      "org",
-      "actor",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
   },
@@ -15479,21 +23479,31 @@
     "description": "A user account was suspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "user_agent",
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "token_scopes",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15501,18 +23511,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor_id",
-      "@timestamp",
-      "operation_type",
-      "_document_id",
-      "user_agent",
-      "actor",
-      "action",
       "user_id",
-      "created_at",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15520,18 +23542,30 @@
     "description": "A 2FA challenge issued for a user account failed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "actor_id",
-      "actor",
-      "user_id",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15541,16 +23575,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
       "user_agent",
-      "request_id",
-      "action",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15558,18 +23604,30 @@
     "description": "A user used their 2FA recovery codes.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15577,18 +23635,30 @@
     "description": "A user downloaded 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15596,17 +23666,30 @@
     "description": "A user printed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15614,18 +23697,30 @@
     "description": "A user viewed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
       "created_at",
-      "user",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15633,17 +23728,30 @@
     "description": "A user was prompted for a two-factor authentication code.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
     "fields": [
-      "user",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "actor"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
   },
@@ -15652,19 +23760,31 @@
     "description": "A user was unblocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "user_agent",
-      "user_id",
-      "user",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -15673,15 +23793,28 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user_agent",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "request_id",
-      "actor",
-      "action",
       "created_at"
     ]
   },
@@ -15690,21 +23823,31 @@
     "description": "A user account was unsuspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "user_agent",
       "actor",
-      "oauth_application_id",
-      "operation_type",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "user_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15712,21 +23855,33 @@
     "description": "A user secret for Codespaces was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15734,18 +23889,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15753,27 +23920,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -15782,23 +23955,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15806,10 +23989,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -15820,20 +24021,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -15842,23 +24032,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15868,10 +24066,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -15883,19 +24099,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -15906,10 +24112,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -15918,21 +24142,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -15942,23 +24155,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -15967,22 +24192,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15990,21 +24226,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -16012,25 +24259,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16038,23 +24293,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -16068,24 +24336,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -16094,10 +24371,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -16107,21 +24402,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -16131,25 +24416,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.14/organization.json b/src/audit-logs/data/ghes-3.14/organization.json
index 33ee317030bb..489dcc450f7f 100644
--- a/src/audit-logs/data/ghes-3.14/organization.json
+++ b/src/audit-logs/data/ghes-3.14/organization.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,29 +67,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -72,21 +103,32 @@
     "description": "Credit was accepted for a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Editing a repository security advisory"
   },
@@ -95,21 +137,32 @@
     "description": "Someone was added to the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -117,21 +170,32 @@
     "description": "Credit was declined for a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -140,21 +204,32 @@
     "description": "Someone was removed from the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -163,18 +238,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -182,17 +269,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -203,39 +301,62 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
+  },
   {
     "action": "billing.change_billing_type",
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -244,19 +365,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -265,18 +398,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -284,18 +430,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -303,20 +461,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -325,20 +494,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -349,17 +529,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -367,14 +559,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -384,28 +591,34 @@
     "description": "An attempt to create a codespace from a prebuild was made.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "owner",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "user_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
       "created_at",
       "operation_type",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -413,17 +626,30 @@
     "description": "Enterprise setting for Codespaces ownership was updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enablement",
       "organization_names",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -434,25 +660,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -463,22 +698,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -490,22 +736,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -514,15 +771,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -533,15 +805,28 @@
     "description": "Policies were applied to codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -551,20 +836,30 @@
     "description": "Policies were removed from codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -572,19 +867,30 @@
     "description": "Policies were updated for codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -592,17 +898,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -612,27 +931,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "owner",
-      "pull_request_id",
-      "machine_type",
-      "user_id",
-      "user",
-      "devcontainer_path",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
+      "machine_type",
+      "devcontainer_path",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -640,19 +968,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -660,18 +1001,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -680,20 +1033,30 @@
     "description": "A commit comment was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "created_at",
-      "@timestamp",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "programmatic_access_type"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -701,21 +1064,30 @@
     "description": "A commit comment was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_id",
-      "action",
-      "@timestamp",
-      "repo",
       "org_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -723,21 +1095,33 @@
     "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "reason",
       "plan",
-      "org_id",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -745,13 +1129,28 @@
     "description": "Copilot feature settings were changed at the organization level.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -761,23 +1160,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -785,16 +1191,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -803,40 +1223,59 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "copilot.cfb_seat_assignment_reused",
-    "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
-      "request_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "copilot.cfb_seat_assignment_reused",
+    "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -846,20 +1285,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -867,19 +1316,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -887,21 +1348,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -909,21 +1379,33 @@
     "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_value",
       "new_value",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -931,21 +1413,32 @@
     "description": "The excluded paths for GitHub Copilot were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "excluded_paths",
       "owner_type",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -953,21 +1446,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -975,21 +1478,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -997,39 +1510,62 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "copilot.plan_changed",
-    "description": "The plan for GitHub Copilot was updated.",
-    "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot",
-    "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
+    ]
+  },
+  {
+    "action": "copilot.plan_changed",
+    "description": "The plan for GitHub Copilot was updated.",
+    "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_plan",
       "plan",
-      "business_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1041,21 +1577,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1065,19 +1610,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1087,21 +1641,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1111,18 +1674,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1135,18 +1711,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1160,14 +1749,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -1180,8 +1784,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1190,27 +1793,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1219,19 +1830,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repository",
-      "repository_id",
-      "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1240,16 +1863,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "definition_id"
@@ -1261,19 +1897,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1282,19 +1929,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1303,19 +1961,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1324,19 +1993,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1345,17 +2025,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1363,19 +2056,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1384,19 +2088,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1404,40 +2119,62 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
-  },
-  {
-    "action": "dependabot_security_updates_new_repos.enable",
-    "description": "Dependabot security updates were enabled for all new repositories.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+  },
+  {
+    "action": "dependabot_security_updates_new_repos.enable",
+    "description": "Dependabot security updates were enabled for all new repositories.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1445,19 +2182,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1466,19 +2214,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1486,19 +2245,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1507,20 +2277,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1528,21 +2308,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "repo_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "org_id",
-      "_document_id",
       "actor_id",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1550,20 +2339,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "request_id",
-      "org",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1571,22 +2370,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "actor_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "title",
-      "_document_id",
-      "created_at",
-      "repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -1594,21 +2402,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "team",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "number",
-      "org",
-      "title",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id"
+      "team",
+      "created_at",
+      "number",
+      "title",
+      "operation_type"
     ]
   },
   {
@@ -1616,18 +2436,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user_id",
-      "actor",
       "number",
-      "user",
-      "created_at",
-      "request_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1635,18 +2468,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "_document_id",
-      "request_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "number",
       "team",
       "created_at"
@@ -1657,21 +2501,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "_document_id",
-      "title",
-      "user",
-      "user_agent",
-      "org",
-      "operation_type",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "team",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type",
+      "team",
       "number"
     ]
   },
@@ -1680,17 +2535,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -1701,16 +2570,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -1721,18 +2604,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "message",
-      "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "message",
+      "old_message",
       "created_at",
       "operation_type"
     ],
@@ -1743,17 +2640,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was created.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "org_id",
       "action",
-      "request_id",
-      "org",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -1762,17 +2672,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "actor_id",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -1781,22 +2704,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1805,22 +2737,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1828,28 +2770,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1858,27 +2806,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1887,25 +2843,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1914,26 +2878,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1942,21 +2913,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1965,22 +2948,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1989,25 +2982,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2016,22 +3018,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2040,21 +3054,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -2065,19 +3089,30 @@
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2086,20 +3121,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2108,19 +3153,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2129,23 +3185,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2153,18 +3218,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2175,20 +3250,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2198,25 +3283,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -2224,25 +3319,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -2250,26 +3354,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -2278,25 +3391,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -2304,26 +3426,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -2331,21 +3462,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -2354,19 +3496,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -2374,21 +3529,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -2397,19 +3563,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -2420,20 +3600,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2443,24 +3635,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2471,23 +3674,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2498,21 +3713,33 @@
     "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
       "operation_type",
-      "@timestamp",
       "integration",
-      "action",
-      "user_agent",
       "reason",
-      "_document_id",
-      "org",
-      "org_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -2523,20 +3750,32 @@
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
       "@timestamp",
-      "actor_id",
-      "org",
       "_document_id",
-      "requester",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "requester",
       "created_at",
       "url",
-      "org_id",
-      "request_id",
       "operation_type",
-      "actor",
       "integration",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -2546,20 +3785,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2569,19 +3821,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -2590,20 +3856,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -2613,20 +3892,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -2635,20 +3927,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -2657,20 +3962,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2678,19 +3995,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2699,19 +4029,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2720,17 +4063,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2743,21 +4099,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -2771,17 +4140,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2793,19 +4175,30 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "user"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2813,19 +4206,30 @@
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2833,20 +4237,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "user_id",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
-      "_document_id",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "actor_id",
       "operation_type",
-      "org",
       "created_at"
     ]
   },
@@ -2855,19 +4268,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2875,24 +4299,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2900,24 +4332,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "ip_allow_list_entry",
-      "org",
-      "operation_type",
-      "created_at",
-      "active",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at",
+      "active"
     ]
   },
   {
@@ -2925,19 +4365,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "actor_id",
       "ip_allow_list_entry",
-      "active",
-      "org_id",
-      "@timestamp"
+      "active"
     ]
   },
   {
@@ -2945,22 +4398,31 @@
     "description": "A comment on an issue was deleted from the repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "org",
-      "repo",
-      "actor_id",
       "@timestamp",
-      "created_at",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "oauth_application_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -2968,24 +4430,30 @@
     "description": "A comment on an issue was pinned to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2996,19 +4464,29 @@
     "description": "A comment on an issue was unpinned from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3019,22 +4497,31 @@
     "description": "A comment on an issue (other than the initial one) changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "action",
-      "repo_id",
-      "org_id",
-      "created_at",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "request_id",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
-      "oauth_application_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -3042,21 +4529,31 @@
     "description": "An issue was deleted from the repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue",
     "fields": [
-      "user",
-      "actor_id",
-      "created_at",
-      "title",
       "@timestamp",
       "_document_id",
-      "request_id",
-      "actor",
-      "user_id",
       "action",
-      "operation_type",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type"
     ],
     "docs_reference_titles": "Deleting an issue"
   },
@@ -3065,23 +4562,33 @@
     "description": "An issue was pinned to a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
       "action",
       "actor",
-      "operation_type",
-      "owner_type",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "number",
-      "repo",
-      "event",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "owner_type",
+      "number",
+      "event"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3090,22 +4597,32 @@
     "description": "An issue was transferred to another repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "owner_type",
-      "actor_id",
       "number",
-      "repo",
       "operation_type",
-      "_document_id",
-      "repo_id",
-      "action",
-      "request_id",
-      "created_at",
-      "actor",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Transferring an issue to another repository"
   },
@@ -3114,24 +4631,33 @@
     "description": "An issue was unpinned from a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
-      "event",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
-      "action",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "operation_type",
-      "_document_id",
-      "number",
-      "owner_type",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "token_scopes",
-      "request_access_security_header"
+      "user_agent",
+      "event",
+      "created_at",
+      "operation_type",
+      "number",
+      "owner_type"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3140,19 +4666,30 @@
     "description": "The ability for enterprise members to delete issues was disabled  Members cannot delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
-      "operation_type",
-      "request_id",
-      "actor_id",
-      "user_id",
-      "created_at",
       "_document_id",
+      "action",
       "actor",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "org_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3161,18 +4698,29 @@
     "description": "The ability for enterprise members to delete issues was enabled  Members can delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -3182,19 +4730,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user",
-      "request_id",
-      "actor",
-      "business_id",
-      "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3203,18 +4762,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3222,21 +4793,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -3244,21 +4828,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3266,22 +4863,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -3289,19 +4899,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -3311,22 +4934,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -3334,22 +4970,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3357,20 +5006,30 @@
     "description": "The ability for members to publish GitHub Pages sites was disabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3379,20 +5038,30 @@
     "description": "The ability for members to publish GitHub Pages sites was enabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3401,21 +5070,30 @@
     "description": "The ability for members to publish private GitHub Pages was disabled  Members cannot publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3424,22 +5102,30 @@
     "description": "The ability for members to publish private GitHub Pages was enabled  Members can publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3448,21 +5134,30 @@
     "description": "The ability for members to publish public GitHub Pages was disabled  Members cannot publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3471,22 +5166,30 @@
     "description": "The ability for members to publish public GitHub Pages was enabled  Members can publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3495,19 +5198,30 @@
     "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "operation_type",
       "user_agent",
-      "actor",
-      "actor_id",
-      "business_id",
-      "@timestamp",
-      "created_at",
-      "action"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3516,18 +5230,29 @@
     "description": "The ability for enterprise members to delete repositories was disabled  Members cannot delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "request_id",
-      "org",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "actor",
       "operation_type",
-      "org_id",
-      "action",
-      "@timestamp",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -3537,21 +5262,30 @@
     "description": "The ability for enterprise members to delete repositories was enabled  Members can delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "action",
-      "org_id",
-      "user_id",
-      "business",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
-      "org",
-      "operation_type",
-      "user_agent"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3562,16 +5296,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -3580,21 +5325,30 @@
     "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "created_at",
-      "user_id",
       "business_id",
-      "user",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "org_id",
-      "@timestamp"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -3603,19 +5357,30 @@
     "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "user_id",
-      "business",
-      "business_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "actor_id"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -3624,19 +5389,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3644,21 +5421,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3668,16 +5454,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3687,18 +5486,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3708,14 +5520,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -3723,19 +5551,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -3743,18 +5582,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3762,23 +5613,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -3786,16 +5645,30 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "org_id",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3803,24 +5676,32 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "org_id",
-      "request_id",
-      "oauth_application_id",
-      "repo_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "created_at",
-      "org",
-      "action",
       "_document_id",
-      "repo",
+      "action",
       "actor",
-      "token_scopes",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ]
   },
   {
@@ -3828,15 +5709,28 @@
     "description": "A network configuration for a hosted compute service was created.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -3854,15 +5748,28 @@
     "description": "A network configuration for a hosted compute service was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -3875,15 +5782,28 @@
     "description": "A network configuration for a hosted compute service was updated.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -3900,20 +5820,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3922,20 +5854,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3944,20 +5888,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3966,20 +5922,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3988,19 +5956,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4009,20 +5990,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4031,20 +6024,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "action",
-      "_document_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4053,19 +6058,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4074,17 +6092,28 @@
     "description": "An invitation sent to an organization to join an enterprise was accepted.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4095,20 +6124,30 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
   },
@@ -4117,21 +6156,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -4140,24 +6189,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4165,21 +6224,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -4187,20 +6256,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4208,22 +6287,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4231,20 +6318,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4252,22 +6349,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4275,19 +6380,30 @@
     "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4296,19 +6412,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -4318,15 +6445,28 @@
     "description": "Third-party application access for outside collaborators was disabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4337,15 +6477,28 @@
     "description": "Third-party application access for outside collaborators was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4356,15 +6509,28 @@
     "description": "The organization was archived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4374,17 +6540,30 @@
     "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
   },
@@ -4393,21 +6572,32 @@
     "description": "An export of the organization's Git events was created.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "start",
       "end",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization"
   },
@@ -4416,16 +6606,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -4434,18 +6637,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org_id",
       "created_at",
-      "_document_id",
       "blocked_user",
-      "action",
-      "operation_type",
-      "actor_id",
-      "org",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -4454,19 +6670,30 @@
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -4476,22 +6703,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "email",
-      "@timestamp",
-      "actor",
-      "action",
       "operation_type",
-      "user_agent",
-      "org",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -4499,19 +6737,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -4519,23 +6768,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4543,21 +6800,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4565,21 +6832,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -4588,21 +6864,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -4611,20 +6896,31 @@
     "description": "Access to use Codespaces on internal and private repositories was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "enablement",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "enablement",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization"
   },
@@ -4633,21 +6929,31 @@
     "description": "Ownership and payment for codespaces was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "owner_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
   },
@@ -4656,16 +6962,29 @@
     "description": "A team has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4675,16 +6994,29 @@
     "description": "A team has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4694,19 +7026,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -4715,17 +7058,30 @@
     "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -4734,21 +7090,30 @@
     "description": "A user has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -4756,21 +7121,30 @@
     "description": "A user has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -4778,16 +7152,29 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
@@ -4797,17 +7184,30 @@
     "description": "The interaction limit for prior contributors only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -4816,17 +7216,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -4836,16 +7249,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -4854,17 +7280,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "org",
-      "created_at",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -4873,17 +7312,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -4892,22 +7344,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -4916,17 +7376,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4937,15 +7408,28 @@
     "description": "Server statistics were exported for the organization.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4956,18 +7440,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
-      "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -4976,20 +7472,31 @@
     "description": "A GitHub Actions secret was created for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -4998,20 +7505,32 @@
     "description": "A GitHub Actions variable was created for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5020,21 +7539,33 @@
     "description": "A Codespaces or Dependabot secret was created for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5042,21 +7573,30 @@
     "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "org_id",
-      "business",
-      "action",
       "@timestamp",
-      "org",
       "_document_id",
-      "business_id",
+      "action",
       "actor",
-      "token_scopes",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "actor_is_bot",
       "oauth_credential_type",
       "managed_oauth_access_id",
@@ -5071,25 +7611,33 @@
     "action": "org_credential_authorization.grant",
     "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on",
-    "fields": [
-      "user_agent",
-      "actor",
+    "fields": [
       "@timestamp",
-      "created_at",
-      "org_id",
-      "business_id",
-      "operation_type",
-      "request_id",
       "_document_id",
       "action",
+      "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "token_scopes",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot",
       "oauth_credential_type",
-      "request_access_security_header",
       "managed_oauth_access_id",
       "managed_token_id",
       "managed_oauth_scopes",
@@ -5103,21 +7651,32 @@
     "description": "An owner revoked authorized credentials.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "oauth_application_id",
-      "org_id",
       "operation_type",
-      "action",
-      "business",
-      "request_id",
       "created_at",
-      "business_id",
-      "actor_id",
-      "_document_id",
-      "user_agent",
       "oauth_credential_type",
       "managed_oauth_access_id",
       "managed_token_id",
@@ -5132,20 +7691,30 @@
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -5154,16 +7723,29 @@
     "description": "Third-party application access restrictions for an organization were disabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization"
@@ -5173,19 +7755,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -5194,14 +7787,31 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sso_url",
       "issuer",
-      "action",
-      "@timestamp",
-      "_document_id",
       "created_at",
-      "org",
       "operation_type"
     ]
   },
@@ -5210,21 +7820,30 @@
     "description": "Display of IP addresses within audit log events for the organization was disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -5233,17 +7852,30 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5251,19 +7883,30 @@
     "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5271,19 +7914,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
-      "action",
-      "actor_id",
-      "org_id"
+      "created_at"
     ]
   },
   {
@@ -5291,19 +7945,30 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -5312,17 +7977,30 @@
     "description": "Third-party application access restrictions for an organization were enabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "operation_type",
-      "org",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization"
   },
@@ -5331,19 +8009,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -5352,19 +8041,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "sso_url",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "issuer",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "sso_url",
+      "created_at",
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -5373,21 +8075,30 @@
     "description": "Display of IP addresses within audit log events for the organization was enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -5396,17 +8107,30 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
   },
@@ -5415,17 +8139,30 @@
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -5434,18 +8171,31 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
-      "org",
-      "user_agent",
-      "request_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "manager",
       "operation_type",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5453,23 +8203,32 @@
     "description": "A new user was invited to join an organization.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
     "fields": [
-      "org",
-      "user_id",
-      "invitation_id",
-      "org_id",
-      "user",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -5478,17 +8237,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5498,19 +8268,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5518,19 +8299,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5538,19 +8330,31 @@
     "description": "Access to an organization was granted for an OAuth App.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "operation_type",
-      "org_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization"
@@ -5560,20 +8364,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -5582,18 +8397,31 @@
     "description": "Access was disabled for an OAuth App that was previously approved.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization",
     "fields": [
-      "request_id",
-      "url",
-      "created_at",
-      "org_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
@@ -5603,19 +8431,31 @@
     "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "url",
-      "org_id",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "url",
       "oauth_application_name"
     ]
   },
@@ -5624,20 +8464,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -5647,16 +8498,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5664,20 +8528,31 @@
     "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "reason",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "reason",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -5686,20 +8561,30 @@
     "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -5708,19 +8593,30 @@
     "description": "An organization owner downloaded the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -5729,19 +8625,30 @@
     "description": "An organization owner generated the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -5750,19 +8657,30 @@
     "description": "An organization owner printed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -5771,19 +8689,30 @@
     "description": "An organization owner viewed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -5792,19 +8721,31 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -5813,20 +8754,31 @@
     "description": "A GitHub Actions secret was removed from an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5835,21 +8787,31 @@
     "description": "A GitHub Actions variable was removed from an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5858,18 +8820,29 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
@@ -5879,22 +8852,32 @@
     "description": "A Codespaces or Dependabot secret was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5902,21 +8885,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5924,21 +8916,30 @@
     "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user",
-      "org_id",
-      "created_at",
-      "request_id",
       "@timestamp",
-      "action",
-      "operation_type",
-      "user_agent",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5946,21 +8947,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -5968,18 +8979,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -5988,19 +9011,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
-      "old_login",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_login",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6008,14 +9043,28 @@
     "description": "Triggered when a required workflow is created.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6026,14 +9075,28 @@
     "description": "Triggered when a required workflow is deleted.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6044,14 +9107,28 @@
     "description": "Triggered when a required workflow is updated.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6062,20 +9139,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -6084,18 +9171,29 @@
     "description": "A member's linked identity was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
       "user_id",
-      "@timestamp",
-      "action",
-      "actor_id",
       "user_agent",
-      "_document_id",
-      "request_id",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
@@ -6105,19 +9203,30 @@
     "description": "A member's SAML session was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
-      "actor_id",
-      "created_at",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
   },
@@ -6126,21 +9235,33 @@
     "description": "A self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -6150,21 +9271,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6173,20 +9304,31 @@
     "description": "A self-hosted runner group was renamed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6195,23 +9337,33 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -6220,23 +9372,31 @@
     "description": "A self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6245,19 +9405,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -6266,25 +9439,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
-      "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "runner_group_selected_workflow_refs",
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6293,21 +9477,32 @@
     "description": "The visibility of a self-hosted runner group was updated via the REST API.",
     "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
   },
@@ -6316,21 +9511,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -6340,21 +9544,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -6364,20 +9577,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6386,22 +9609,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6410,21 +9641,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6433,21 +9673,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6456,22 +9705,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6480,21 +9737,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6503,22 +9769,30 @@
     "description": "Generic secrets have been disabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6526,22 +9800,30 @@
     "description": "Generic secrets have been enabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6549,21 +9831,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -6573,21 +9864,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -6597,19 +9897,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -6619,21 +9930,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -6643,21 +9963,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -6667,19 +9996,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -6689,22 +10029,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6713,22 +10061,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6737,22 +10093,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6761,21 +10125,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6784,21 +10157,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6807,22 +10189,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6831,22 +10221,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6855,15 +10253,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -6872,15 +10287,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -6889,7 +10321,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -6904,20 +10357,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -6926,16 +10390,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -6946,18 +10423,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -6966,17 +10456,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6984,18 +10487,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -7004,18 +10519,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -7024,18 +10552,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -7044,22 +10584,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issuer",
-      "business",
       "operation_type",
       "created_at",
-      "request_id",
-      "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7067,21 +10617,32 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
   },
@@ -7090,19 +10651,30 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -7113,15 +10685,28 @@
     "description": "The organization was unarchived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7131,19 +10716,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
-      "_document_id",
       "blocked_user",
-      "action",
       "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
-      "actor",
-      "actor_id",
-      "org",
-      "org_id",
-      "user_agent"
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -7152,20 +10750,32 @@
     "description": "A GitHub Actions secret was updated for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "created_at",
       "key",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -7174,23 +10784,34 @@
     "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -7199,20 +10820,32 @@
     "description": "A GitHub Actions variable was updated for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -7221,20 +10854,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -7242,22 +10887,33 @@
     "description": "A Codespaces or Dependabot secret was updated for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7266,20 +10922,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -7287,17 +10954,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -7307,20 +10987,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -7329,17 +11020,30 @@
     "description": "The name of the default branch was changed for new repositories in the organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
   },
@@ -7348,17 +11052,30 @@
     "description": "The repository self-hosted runners policy was updated",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_repo_runners_policy",
       "new_repo_runners_policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -7369,19 +11086,32 @@
     "description": "An organization's SAML provider settings were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "issuer",
-      "org",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -7389,18 +11119,30 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "org",
-      "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
@@ -7409,18 +11151,30 @@
     "description": "A default label was created for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
-      "_document_id",
-      "action",
-      "created_at",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label"
   },
@@ -7429,17 +11183,30 @@
     "description": "A default label was deleted for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label"
   },
@@ -7448,17 +11215,30 @@
     "description": "A default label was edited for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label",
     "fields": [
-      "org",
-      "created_at",
       "@timestamp",
-      "actor",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label"
   },
@@ -7467,20 +11247,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "org_id",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -7489,16 +11282,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -7507,14 +11315,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -7525,16 +11348,31 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "domain_name",
-      "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
-      "_document_id",
-      "actor_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -7543,16 +11381,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -7562,17 +11413,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7582,16 +11444,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -7601,20 +11476,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -7622,19 +11507,30 @@
     "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor",
-      "business_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
       "user_agent",
-      "_document_id",
       "created_at",
-      "operation_type",
-      "request_id",
-      "business"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -7643,19 +11539,30 @@
     "description": "Organization projects were disabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -7664,18 +11571,29 @@
     "description": "Organization projects were enabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor_id",
-      "org_id",
-      "created_at",
-      "user_id",
-      "org",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
@@ -7685,23 +11603,33 @@
     "description": "An organization role was assigned to a user or team.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About custom organization roles"
   },
@@ -7710,25 +11638,32 @@
     "description": "A custom organization role was created in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "name",
-      "owner",
-      "role_permissions",
-      "base_role",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "role_permissions",
+      "base_role",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -7740,25 +11675,32 @@
     "description": "A custom organization role was deleted in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -7769,19 +11711,30 @@
     "description": "A user or team was unassigned an organization role.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type"
     ],
@@ -7792,26 +11745,33 @@
     "description": "A custom organization role was edited in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
       "old_role_permissions",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -7824,20 +11784,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -7847,23 +11818,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -7872,21 +11854,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -7897,21 +11890,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -7920,20 +11926,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -7942,17 +11962,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -7963,20 +11998,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -7985,18 +12034,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8004,16 +12065,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8021,18 +12096,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8040,18 +12127,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8062,18 +12162,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8084,17 +12197,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8105,18 +12231,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8128,17 +12267,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8150,20 +12302,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -8175,20 +12336,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -8200,20 +12370,29 @@
     "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -8225,20 +12404,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -8250,15 +12438,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8268,17 +12471,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8288,15 +12502,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8306,19 +12535,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "business_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8326,23 +12566,30 @@
     "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "created_at",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
-      "repo",
       "action",
-      "user_agent",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "request_id",
-      "user_id",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8350,23 +12597,30 @@
     "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "repo",
-      "org",
-      "business",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org_id",
-      "created_at",
-      "business_id"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8374,17 +12628,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8394,17 +12659,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8414,17 +12690,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8434,17 +12721,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8454,17 +12752,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -8474,17 +12785,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8492,20 +12816,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -8515,17 +12850,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8533,17 +12881,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8551,18 +12912,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -8571,18 +12944,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -8591,19 +12976,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -8611,17 +13007,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -8633,22 +13042,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -8656,19 +13074,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8676,17 +13105,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8694,18 +13136,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -8713,20 +13168,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8734,18 +13199,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -8754,18 +13231,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -8774,22 +13263,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -8798,29 +13297,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8828,24 +13332,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "repo_id",
-      "user_id",
       "@timestamp",
-      "user_agent",
-      "repo",
-      "name",
-      "org_id",
-      "user",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -8856,21 +13368,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -8881,22 +13403,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -8904,24 +13436,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "authorized_actors_only",
       "authorized_actors",
       "created_at",
-      "user_agent",
       "name",
-      "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
-      "actor_id",
-      "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -8929,30 +13471,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -8962,28 +13511,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -8994,23 +13551,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -9018,22 +13584,32 @@
     "description": "Branch deletion was enabled or disabled for a protected branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "operation_type",
-      "request_id",
-      "repo",
       "@timestamp",
-      "org_id",
-      "org",
-      "action",
-      "allow_deletions_enforcement_level",
       "_document_id",
-      "created_at",
-      "actor_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_deletions_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -9041,23 +13617,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "actor_id",
-      "name",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo",
-      "operation_type",
-      "request_id",
-      "allow_force_pushes_enforcement_level",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_force_pushes_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -9065,24 +13650,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -9091,22 +13685,32 @@
     "description": "Required linear commit history was enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "operation_type",
       "actor",
-      "linear_history_requirement_enforcement_level",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "linear_history_requirement_enforcement_level",
       "name",
-      "org_id",
-      "repo_id",
-      "org",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -9114,24 +13718,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "lock_allows_fetch_and_merge",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -9140,27 +13753,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -9169,18 +13789,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9191,24 +13824,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -9216,25 +13858,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9242,22 +13891,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -9265,22 +13924,33 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
   },
@@ -9289,22 +13959,32 @@
     "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "required_approving_review_count",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -9312,25 +13992,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
     ]
   },
   {
@@ -9338,22 +14025,32 @@
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
       "action",
       "actor",
       "actor_id",
-      "signature_requirement_enforcement_level",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "programmatic_access_type"
+      "operation_type",
+      "name",
+      "created_at",
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -9361,22 +14058,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "created_at",
-      "repo_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "name",
-      "actor",
-      "repo",
       "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
+      "strict_required_status_checks_policy"
     ]
   },
   {
@@ -9384,23 +14091,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -9409,24 +14127,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "fingerprint",
       "read_only",
       "explanation",
-      "repo",
-      "@timestamp",
-      "action",
       "key",
       "operation_type",
-      "_document_id",
-      "actor",
       "title",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "created_at",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -9435,20 +14164,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -9457,21 +14200,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -9481,22 +14237,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -9505,25 +14273,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -9532,23 +14310,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -9557,18 +14346,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -9578,21 +14381,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -9601,19 +14415,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -9624,23 +14451,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "pull_request_id",
-      "business_id",
-      "org_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -9650,17 +14489,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -9668,19 +14521,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -9688,19 +14554,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -9710,21 +14589,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -9733,27 +14623,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "pull_request_url",
       "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9761,23 +14658,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -9786,18 +14695,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -9805,19 +14728,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -9827,20 +14762,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "request_id",
       "comment_id",
-      "actor_id",
-      "repo_id",
-      "action",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -9848,18 +14794,31 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "_document_id",
-      "@timestamp",
-      "comment_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "comment_id"
     ]
   },
   {
@@ -9867,21 +14826,33 @@
     "description": "A review on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -9889,20 +14860,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -9911,19 +14895,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -9933,22 +14931,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -9957,21 +14965,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -9980,25 +14997,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -10007,23 +15031,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -10032,24 +15064,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -10058,23 +15097,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -10084,22 +15131,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -10108,19 +15164,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -10129,24 +15198,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -10155,24 +15234,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -10180,24 +15267,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -10205,23 +15300,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -10232,25 +15336,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -10259,26 +15369,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -10287,25 +15405,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "query_suite",
       "threat_model",
       "languages",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -10315,19 +15442,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to this repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -10336,19 +15474,30 @@
     "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -10356,17 +15505,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -10375,15 +15537,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -10394,16 +15569,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -10413,17 +15601,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -10433,19 +15634,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -10454,17 +15666,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -10473,26 +15698,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -10501,30 +15732,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -10534,20 +15770,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -10556,25 +15803,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -10583,23 +15838,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -10607,25 +15873,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -10635,23 +15910,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -10661,23 +15945,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -10685,21 +15979,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -10707,21 +16011,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -10729,22 +16043,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -10752,21 +16075,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -10774,20 +16107,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -10795,22 +16139,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10818,18 +16171,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10837,22 +16204,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10860,21 +16237,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -10882,18 +16269,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "created_at",
-      "_document_id",
-      "request_id",
-      "repo_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -10902,22 +16301,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -10926,24 +16334,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -10952,23 +16368,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -10976,26 +16402,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -11004,21 +16435,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -11027,25 +16467,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11053,22 +16499,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -11077,25 +16533,34 @@
     "description": "A branch was renamed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "old_branch",
-      "new_branch",
-      "default_branch",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "old_branch",
+      "new_branch",
+      "default_branch",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch"
@@ -11105,19 +16570,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11125,17 +16601,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -11144,17 +16635,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -11163,7 +16669,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -11178,23 +16705,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -11204,20 +16740,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11228,21 +16775,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -11251,22 +16809,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -11275,21 +16843,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -11298,22 +16877,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -11324,16 +16913,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -11343,22 +16943,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -11367,23 +16978,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11393,19 +17014,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -11413,21 +17044,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -11436,24 +17077,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -11461,25 +17111,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -11488,24 +17145,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11514,25 +17181,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -11541,22 +17216,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11565,26 +17249,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11592,31 +17284,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11625,22 +17324,30 @@
     "description": "Someone closed a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories",
     "fields": [
-      "actor",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "created_at",
-      "repo_id",
-      "_document_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "About repository security advisories"
   },
@@ -11649,18 +17356,29 @@
     "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "_document_id",
+      "operation_type",
       "created_at"
     ]
   },
@@ -11669,17 +17387,30 @@
     "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -11688,21 +17419,30 @@
     "description": "GitHub withdrew a security advisory that was published in error.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -11710,18 +17450,30 @@
     "description": "Someone opened a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
       "repo_id",
-      "action",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11729,21 +17481,30 @@
     "description": "Someone published a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "repo_id",
       "_document_id",
-      "repo",
-      "business_id",
-      "business",
-      "request_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "org"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11751,17 +17512,30 @@
     "description": "Someone reopened as draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "repo",
-      "action",
-      "created_at",
       "@timestamp",
-      "request_id",
-      "actor_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "public_repo"
     ]
   },
@@ -11770,21 +17544,30 @@
     "description": "Someone edited a draft or published security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "repo_id",
-      "org_id",
       "business",
-      "actor",
-      "user_agent",
-      "created_at",
-      "_document_id",
       "business_id",
-      "repo",
-      "action",
-      "operation_type",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -11792,24 +17575,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -11818,24 +17607,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -11844,19 +17639,30 @@
     "description": "Data use settings were disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "repo_id",
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -11865,21 +17671,30 @@
     "description": "Data use settings were enabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "org",
-      "user_id",
-      "repo_id",
       "@timestamp",
-      "request_id",
-      "actor",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org_id",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -11888,23 +17703,30 @@
     "description": "The dependency graph was disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "repo_id",
-      "operation_type",
-      "user_id",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
-      "@timestamp",
-      "org_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -11913,24 +17735,31 @@
     "description": "The dependency graph was enabled for a private repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor_id",
-      "repo_id",
+      "created_at",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11939,43 +17768,63 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
     "action": "repository_image.destroy",
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
-    "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -11983,21 +17832,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -12005,20 +17865,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -12026,21 +17898,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12048,19 +17931,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -12068,19 +17964,30 @@
     "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise  Organization owners can now control their repository projects settings.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "user_agent",
-      "user",
-      "business_id",
-      "business",
-      "operation_type",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -12089,20 +17996,30 @@
     "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
       "@timestamp",
-      "repo",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "repo_id",
-      "actor",
-      "request_id",
-      "programmatic_access_type"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12111,20 +18028,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
       "created_at",
-      "org_id",
-      "action",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "actor_id",
-      "repo"
+      "operation_type"
     ]
   },
   {
@@ -12132,31 +18058,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -12165,19 +18099,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -12185,8 +18130,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -12195,23 +18139,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -12236,26 +18189,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -12264,26 +18223,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -12292,23 +18257,30 @@
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12318,23 +18290,30 @@
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12344,24 +18323,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12371,24 +18357,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -12397,24 +18390,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12424,23 +18424,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12450,23 +18457,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -12475,22 +18490,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12498,24 +18521,32 @@
     "description": "Generic secrets have been disabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -12523,22 +18554,31 @@
     "description": "Generic secrets have been enabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -12547,24 +18587,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -12573,24 +18621,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -12599,19 +18655,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12620,24 +18688,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12646,24 +18722,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "actor_id",
-      "user_agent",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12672,19 +18756,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12693,26 +18789,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12721,26 +18822,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12749,20 +18855,30 @@
     "description": "The repository visibility change setting was cleared for an organization or enterprise.",
     "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
       "business",
-      "action",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business_id",
-      "@timestamp",
       "user_agent",
-      "actor",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise"
   },
@@ -12771,20 +18887,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "org_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
-      "user_id",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12792,19 +18918,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "_document_id",
       "@timestamp",
-      "user_agent",
-      "user",
-      "created_at",
-      "org",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12812,29 +18949,37 @@
     "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -12843,29 +18988,37 @@
     "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
+      "operation_type",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -12874,19 +19027,32 @@
     "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
-      "operation_type",
-      "request_id",
-      "repo_id",
       "@timestamp",
-      "user_agent",
-      "alert_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "alert_id",
+      "created_at",
+      "alert_number"
     ],
     "docs_reference_titles": "About Dependabot alerts"
   },
@@ -12895,23 +19061,32 @@
     "description": "A Dependabot alert was manually dismissed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "alert_id",
-      "actor",
-      "repo",
       "created_at",
-      "org",
-      "_document_id",
-      "action",
-      "actor_id",
       "dismiss_reason",
-      "user",
       "dismiss_comment",
       "alert_number",
       "actor_is_bot"
@@ -12922,21 +19097,33 @@
     "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "public_repo",
       "owner",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "token_scopes",
       "alert_number"
     ]
   },
@@ -12945,26 +19132,34 @@
     "description": "A Dependabot alert was manually reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo",
-      "alert_number",
-      "request_access_security_header"
+      "alert_number"
     ]
   },
   {
@@ -12972,21 +19167,32 @@
     "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "alert_id",
-      "repo",
-      "operation_type",
-      "action",
-      "repo_id",
-      "_document_id",
-      "user_agent",
-      "request_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "operation_type",
+      "created_at",
+      "alert_number"
     ]
   },
   {
@@ -12994,20 +19200,30 @@
     "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
     "fields": [
-      "org",
+      "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
-      "operation_type",
-      "created_at",
-      "actor",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
   },
@@ -13016,24 +19232,31 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13041,26 +19264,32 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13068,23 +19297,30 @@
     "description": "Dependabot alerts was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "request_id",
-      "repo_id",
-      "action",
-      "actor_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "_document_id",
       "user_id",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13092,23 +19328,30 @@
     "description": "Dependabot alerts was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_agent",
-      "created_at",
       "@timestamp",
-      "repo_id",
+      "_document_id",
       "action",
-      "user",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor_id",
-      "_document_id",
-      "user_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -13117,24 +19360,31 @@
     "description": "A status check was marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "org",
-      "actor_id",
       "@timestamp",
-      "business",
-      "request_id",
-      "context",
-      "repo_id",
-      "action",
-      "repo",
       "_document_id",
-      "operation_type",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "created_at",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "context",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -13143,21 +19393,31 @@
     "description": "A status check was no longer marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "actor_id",
-      "actor",
-      "created_at",
-      "context",
-      "operation_type",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "repo_id",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
       "repo",
-      "programmatic_access_type"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "context",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -13166,18 +19426,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -13186,19 +19459,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -13207,22 +19492,33 @@
     "description": "A new custom repository role was created.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "role_permissions",
       "old_role_permissions"
     ],
@@ -13233,23 +19529,34 @@
     "description": "A custom repository role was deleted.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing custom repository roles for an organization"
   },
@@ -13258,23 +19565,34 @@
     "description": "A custom repository role was edited.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "old_role_permissions",
       "old_base_role"
     ],
@@ -13285,14 +19603,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -13306,22 +19638,32 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
@@ -13330,28 +19672,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -13359,25 +19710,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13385,14 +19743,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -13409,19 +19781,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13430,19 +19813,30 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13451,20 +19845,30 @@
     "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13473,19 +19877,30 @@
     "description": "Secret scanning was enabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13494,14 +19909,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -13519,25 +19948,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13546,25 +19983,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -13574,25 +20019,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -13601,16 +20054,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -13620,18 +20086,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -13640,16 +20119,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -13659,15 +20151,28 @@
     "description": "An agreement for invoiced billing for GitHub Sponsors was signed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -13679,15 +20184,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -13697,15 +20215,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -13714,17 +20247,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -13733,17 +20279,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -13752,16 +20312,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -13771,14 +20344,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -13788,17 +20376,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -13807,17 +20408,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -13826,18 +20440,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -13846,15 +20473,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -13864,16 +20505,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13881,15 +20535,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -13900,16 +20567,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "@timestamp",
-      "_document_id",
       "user_agent",
-      "actor_id",
-      "user",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -13919,17 +20599,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -13940,17 +20633,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -13961,18 +20667,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -13982,16 +20699,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14001,16 +20731,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14022,17 +20765,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -14041,19 +20797,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -14062,21 +20831,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "user",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
       "action",
-      "user_id",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "actor_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -14085,19 +20863,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -14106,15 +20895,28 @@
     "description": "Dependabot encrypted config was read.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "public_repo"
@@ -14125,20 +20927,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14146,18 +20962,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -14165,16 +20996,31 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "domain_name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14182,21 +21028,31 @@
     "description": "A member of an organization was added to a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
-      "user",
       "@timestamp",
-      "actor_id",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "org",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -14206,22 +21062,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -14230,20 +21095,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -14252,18 +21128,31 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
       "created_at",
       "operation_type",
-      "actor_id",
-      "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
@@ -14273,21 +21162,32 @@
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -14296,21 +21196,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -14319,19 +21229,31 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "team",
       "org_id",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
       "operation_type",
-      "_document_id",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -14340,19 +21262,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
       "business",
-      "action",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14360,19 +21293,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "request_id",
       "actor",
-      "org",
-      "created_at",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14380,18 +21324,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
       "@timestamp",
-      "action",
       "_document_id",
-      "user_agent",
-      "user_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -14400,19 +21355,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "actor",
-      "action",
-      "operation_type",
-      "team",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -14420,19 +21387,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "actor_id",
       "_document_id",
-      "team",
-      "created_at",
-      "org_id",
       "action",
-      "request_id",
-      "user_agent",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_access_security_header"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "team",
+      "created_at"
     ]
   },
   {
@@ -14440,22 +21419,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "team",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14463,22 +21451,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -14487,22 +21484,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -14510,23 +21516,33 @@
   {
     "action": "team.remove_repository",
     "description": "A repository was removed from a team's control.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "org",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -14534,21 +21550,32 @@
     "description": "A team's name was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "user_agent",
-      "created_at",
-      "team",
-      "operation_type",
-      "actor_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -14557,17 +21584,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -14576,19 +21616,30 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -14597,19 +21648,30 @@
     "description": "The Okta credentials for team synchronization with a tenant were changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -14617,28 +21679,37 @@
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
       "operation_type",
       "created_at",
-      "user_agent",
       "permission",
       "new_repo_permission",
       "new_repo_base_role",
       "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_repo_base_role"
     ]
   },
   {
@@ -14646,16 +21717,30 @@
     "description": "A Dependabot rule was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14665,16 +21750,30 @@
     "description": "A Dependabot rule was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14684,18 +21783,31 @@
     "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14705,21 +21817,33 @@
     "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -14727,21 +21851,32 @@
     "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -14749,21 +21884,32 @@
     "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -14771,16 +21917,30 @@
     "description": "A Dependabot rule's conditions, actions, or metadata changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14790,27 +21950,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -14819,23 +21985,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -14843,10 +22019,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -14857,20 +22051,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -14879,23 +22062,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14905,10 +22096,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -14920,19 +22129,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -14943,10 +22142,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -14955,21 +22172,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -14979,23 +22185,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -15004,22 +22222,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15027,21 +22256,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -15049,25 +22289,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15075,23 +22323,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -15105,24 +22366,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -15131,10 +22401,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -15144,21 +22432,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -15168,25 +22446,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.14/user.json b/src/audit-logs/data/ghes-3.14/user.json
index a5aecbaf6331..315369a09f99 100644
--- a/src/audit-logs/data/ghes-3.14/user.json
+++ b/src/audit-logs/data/ghes-3.14/user.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,17 +67,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
-      "user_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -61,18 +98,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
+      "token_scopes",
       "user",
-      "request_id",
-      "_document_id",
-      "user_agent",
-      "actor",
       "user_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -80,18 +129,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "token_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -99,29 +160,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -129,18 +196,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -148,17 +227,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -167,19 +259,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -188,18 +292,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -207,18 +324,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -226,15 +355,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -244,17 +386,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -265,20 +420,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -287,19 +454,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -308,19 +488,31 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -329,20 +521,32 @@
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -351,19 +555,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -372,20 +588,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -394,20 +621,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -418,17 +656,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -436,14 +686,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -453,25 +718,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -482,22 +756,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -509,22 +794,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -533,15 +829,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -552,17 +863,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -572,27 +896,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "org",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -600,38 +933,63 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "owner",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "codespaces.trusted_repositories_access_update",
-    "description": "A personal account's access and security setting for Codespaces were updated.",
-    "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
+      "operation_type",
       "created_at",
-      "_document_id"
+      "public_repo"
+    ]
+  },
+  {
+    "action": "codespaces.trusted_repositories_access_update",
+    "description": "A personal account's access and security setting for Codespaces were updated.",
+    "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -640,23 +998,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -664,16 +1029,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -682,24 +1061,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -707,15 +1092,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -725,20 +1123,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -746,19 +1154,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -766,65 +1186,92 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id"
-    ]
-  },
-  {
-    "action": "custom_hosted_runner.create",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "name",
-      "runner_group_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
   },
   {
-    "action": "custom_hosted_runner.destroy",
+    "action": "custom_hosted_runner.create",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "custom_hosted_runner.destroy",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -834,21 +1281,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -858,19 +1314,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -879,19 +1346,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -900,19 +1378,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -921,19 +1410,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -942,17 +1442,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -960,19 +1473,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -981,39 +1505,61 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
-    ]
-  },
-  {
-    "action": "dependabot_security_updates_new_repos.disable",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "dependabot_security_updates_new_repos.disable",
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1022,19 +1568,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1042,19 +1599,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1063,19 +1631,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1083,19 +1662,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1104,20 +1694,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1125,22 +1725,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1149,22 +1758,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1172,28 +1791,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "business",
       "business_id",
-      "public_repo",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "visibility",
+      "operation_type",
+      "created_at",
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1202,27 +1827,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1231,25 +1864,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1258,26 +1899,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1286,21 +1934,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1309,22 +1969,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1333,25 +2003,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1360,22 +2039,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1384,23 +2075,33 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "new_value",
-      "approvers_was",
-      "approvers",
       "programmatic_access_type",
-      "can_admins_bypass",
-      "prevent_self_review"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_value",
+      "approvers_was",
+      "approvers",
+      "can_admins_bypass",
+      "prevent_self_review"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1409,21 +2110,32 @@
     "description": "A gist was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "gist_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "visibility",
-      "action",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ]
   },
   {
@@ -1431,20 +2143,32 @@
     "description": "A gist was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "gist_id",
-      "visibility",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "user",
-      "request_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "programmatic_access_type"
+      "gist_id",
+      "visibility",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1452,21 +2176,32 @@
     "description": "The visibility of a gist was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "user",
-      "gist_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "visibility",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "gist_id",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -1474,22 +2209,33 @@
     "description": "An SSH key was added to a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1498,23 +2244,34 @@
     "description": "An SSH key was removed from a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
       "explanation",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1523,23 +2280,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1547,18 +2313,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1569,20 +2345,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1592,37 +2378,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "user",
-      "operation_type",
       "_document_id",
-      "actor",
       "action",
-      "user_agent",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "gpg_key.destroy",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "gpg_key.destroy",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1630,25 +2440,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -1656,25 +2476,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -1682,26 +2511,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -1710,25 +2548,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -1736,26 +2583,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -1763,21 +2619,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -1786,41 +2653,65 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "actor_id",
-      "request_id",
       "@timestamp",
-      "name",
-      "integration",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "created_at",
-      "user_agent"
-    ]
-  },
-  {
-    "action": "integration.generate_client_secret",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "integration.generate_client_secret",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -1829,19 +2720,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -1852,20 +2757,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -1875,24 +2792,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -1903,23 +2831,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -1930,20 +2870,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -1953,19 +2906,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -1974,20 +2941,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -1997,20 +2977,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -2019,20 +3012,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -2041,20 +3047,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2062,19 +3080,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2083,19 +3114,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2104,17 +3148,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2127,21 +3184,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -2155,17 +3225,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2177,18 +3260,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2196,43 +3291,69 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
-      "marketplace_listing",
-      "integration",
-      "action"
-    ]
-  },
-  {
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "secondary_category",
+      "primary_category",
+      "operation_type",
+      "created_at",
+      "marketplace_listing",
+      "integration"
+    ]
+  },
+  {
     "action": "marketplace_listing.change_category",
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2240,22 +3361,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -2263,19 +3397,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -2286,21 +3433,36 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
       "marketplace_listing",
       "has_free_trial",
-      "user_agent",
-      "request_id",
-      "actor_id",
       "yearly_price_in_cents",
       "description",
       "bullets",
       "monthly_price_in_cents",
-      "marketplace_listing_plan",
-      "_document_id"
+      "marketplace_listing_plan"
     ]
   },
   {
@@ -2308,22 +3470,37 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "marketplace_listing_plan",
       "marketplace_listing",
       "description",
       "bullets",
       "has_free_trial",
       "created_at",
-      "actor_id",
       "operation_type",
-      "_document_id",
-      "action",
-      "user_agent",
-      "request_id",
-      "actor",
       "monthly_price_in_cents",
-      "yearly_price_in_cents",
-      "@timestamp"
+      "yearly_price_in_cents"
     ]
   },
   {
@@ -2331,21 +3508,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "marketplace_listing_plan",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "marketplace_listing_plan",
       "description",
       "yearly_price_in_cents",
-      "@timestamp",
       "created_at",
-      "actor_id",
       "bullets",
       "has_free_trial",
       "marketplace_listing",
-      "user_agent",
       "monthly_price_in_cents",
-      "action",
       "operation_type"
     ]
   },
@@ -2354,21 +3546,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "monthly_price_in_cents",
-      "marketplace_listing",
+      "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "monthly_price_in_cents",
+      "marketplace_listing",
       "description",
       "bullets",
       "yearly_price_in_cents",
-      "request_id",
-      "actor_id",
       "has_free_trial",
       "marketplace_listing_plan",
-      "user_agent",
-      "@timestamp",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -2377,22 +3584,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -2400,22 +3620,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2423,19 +3656,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2443,21 +3688,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2467,16 +3721,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2486,18 +3753,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2507,14 +3787,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2522,19 +3818,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -2542,18 +3849,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2561,23 +3880,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -2585,20 +3912,30 @@
     "description": "An OAuth access token was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
     "fields": [
-      "_document_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "user",
-      "user_id",
-      "created_at",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "request_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
@@ -2609,19 +3946,30 @@
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "explanation",
-      "hashed_token",
-      "actor_id",
-      "token_scopes",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
@@ -2631,19 +3979,30 @@
     "description": "An OAuth access token was regenerated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "_document_id",
-      "created_at",
       "@timestamp",
-      "operation_type",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ]
   },
@@ -2652,18 +4011,30 @@
     "description": "An OAuth access token was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2671,20 +4042,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2693,20 +4076,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2715,20 +4110,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2737,20 +4144,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2759,19 +4178,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2780,20 +4212,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2802,20 +4246,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2824,19 +4280,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2845,24 +4314,31 @@
     "description": "An authorization for an OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "user_id",
-      "actor",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
       "actor_id",
-      "user",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "actor_is_bot",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -2872,20 +4348,31 @@
     "description": "An authorization for an OAuth application was deleted.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "actor",
       "created_at",
       "explanation",
-      "user",
-      "user_id",
-      "org_id",
-      "action",
-      "actor_id",
-      "token_scopes",
       "actor_is_bot",
       "oauth_application_name"
     ],
@@ -2896,21 +4383,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -2919,24 +4416,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2944,20 +4451,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -2965,22 +4482,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -2988,20 +4513,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3009,22 +4544,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3032,21 +4575,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3054,20 +4606,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -3076,16 +4639,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -3096,18 +4672,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -3116,18 +4705,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -3136,18 +4737,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -3156,18 +4770,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -3177,20 +4803,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -3198,17 +4835,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -3218,20 +4868,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -3240,20 +4901,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -3262,17 +4937,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3283,20 +4973,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -3305,19 +5009,31 @@
     "description": "A new passkey was added.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3325,19 +5041,31 @@
     "description": "A new passkey was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3345,18 +5073,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3364,16 +5104,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3381,18 +5135,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3400,18 +5166,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3422,18 +5201,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3444,17 +5236,30 @@
     "description": "Triggered when you create a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3464,19 +5269,31 @@
     "description": "Triggered when you regenerate a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3484,12 +5301,29 @@
     "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
     "fields": [
-      "user_programmatic_access_name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
       "operation_type"
     ],
@@ -3500,20 +5334,32 @@
     "description": "Triggered when you delete a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "explanation",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3521,17 +5367,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -3542,18 +5401,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -3565,17 +5437,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -3587,17 +5472,30 @@
     "description": "A fine-grained personal access token was updated.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3608,15 +5506,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3626,17 +5539,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3646,15 +5570,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3664,17 +5603,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3684,17 +5634,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3704,17 +5665,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3724,17 +5696,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3744,17 +5727,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -3764,17 +5760,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3782,20 +5791,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -3805,17 +5825,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3823,17 +5856,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3841,18 +5887,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -3861,18 +5919,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -3881,19 +5951,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -3901,17 +5982,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -3923,22 +6017,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -3946,19 +6049,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3966,17 +6080,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3984,39 +6111,62 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "actor"
-    ]
-  },
-  {
-    "action": "project.update_user_permission",
-    "description": "A user was added to or removed from a project board or had their permission level changed.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
-      "@timestamp",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "actor",
       "created_at",
-      "org",
+      "operation_type",
+      "team"
+    ]
+  },
+  {
+    "action": "project.update_user_permission",
+    "description": "A user was added to or removed from a project board or had their permission level changed.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
       "_document_id",
-      "org_id",
       "action",
-      "programmatic_access_type"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4024,18 +6174,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -4044,18 +6206,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -4064,18 +6238,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4086,23 +6273,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -4111,24 +6309,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -4137,20 +6346,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4159,21 +6382,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -4183,22 +6419,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4207,25 +6455,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4234,23 +6492,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4259,22 +6528,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -4283,21 +6562,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -4306,25 +6594,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -4333,23 +6628,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -4358,24 +6661,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -4384,23 +6694,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -4410,22 +6728,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -4434,19 +6761,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -4455,24 +6795,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -4481,23 +6831,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4508,17 +6867,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -4527,15 +6899,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -4546,16 +6931,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -4565,17 +6963,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -4585,19 +6996,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -4606,17 +7028,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -4625,26 +7060,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -4653,30 +7094,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -4686,20 +7132,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -4708,25 +7165,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -4735,23 +7200,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -4759,25 +7235,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -4787,23 +7272,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -4811,21 +7306,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -4833,21 +7338,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
-      "action",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -4855,22 +7370,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -4878,21 +7402,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -4900,20 +7434,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -4921,22 +7466,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4944,18 +7498,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4963,22 +7531,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4986,21 +7564,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5008,42 +7596,63 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "Adding self-hosted runners"
-  },
-  {
-    "action": "repo.remove_actions_secret",
-    "description": "A GitHub Actions secret was deleted for a repository.",
-    "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Adding self-hosted runners"
+  },
+  {
+    "action": "repo.remove_actions_secret",
+    "description": "A GitHub Actions secret was deleted for a repository.",
+    "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
+    "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5052,24 +7661,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5078,23 +7695,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5102,26 +7729,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -5130,21 +7762,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -5153,25 +7794,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5179,22 +7826,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -5203,43 +7860,63 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
-    ]
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "repo.set_actions_fork_pr_approvals_policy",
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -5249,20 +7926,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -5273,21 +7961,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -5296,22 +7995,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -5320,21 +8029,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -5343,22 +8063,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -5369,16 +8099,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -5387,22 +8128,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -5412,22 +8162,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -5436,23 +8197,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
-      "new_nwo",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_nwo",
+      "visibility",
+      "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5462,19 +8233,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -5482,21 +8263,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -5505,24 +8296,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5530,25 +8330,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5557,24 +8364,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -5583,25 +8400,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5610,22 +8435,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -5634,26 +8468,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5661,31 +8503,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -5694,21 +8543,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -5716,21 +8575,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5738,21 +8607,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -5760,20 +8640,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5781,21 +8673,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5803,19 +8706,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -5823,31 +8739,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -5856,19 +8780,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -5876,8 +8811,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -5886,23 +8820,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -5927,18 +8870,30 @@
     "description": "A security key was registered for an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5946,18 +8901,30 @@
     "description": "A security key was removed from an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5965,16 +8932,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5984,18 +8964,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -6004,16 +8997,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6024,15 +9030,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -6042,15 +9061,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -6059,17 +9093,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -6078,35 +9125,62 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
-      "actor",
-      "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
-  },
-  {
-    "action": "sponsors.sponsor_sponsorship_preference_change",
-    "description": "The option to receive email updates from a sponsored account was changed.",
-    "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
-    "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "created_at",
-      "user",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
+  },
+  {
+    "action": "sponsors.sponsor_sponsorship_preference_change",
+    "description": "The option to receive email updates from a sponsored account was changed.",
+    "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -6116,14 +9190,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -6133,17 +9222,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -6152,17 +9254,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -6171,18 +9286,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6191,15 +9319,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -6209,16 +9351,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6226,15 +9381,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -6245,16 +9413,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -6264,17 +9445,30 @@
     "description": "Triggered when you send an email update to your sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
     "fields": [
-      "request_id",
-      "actor",
-      "action",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
   },
@@ -6283,17 +9477,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -6304,17 +9511,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -6325,18 +9545,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6346,16 +9577,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6365,17 +9609,30 @@
     "description": "You join the waitlist to join GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "actor_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -6384,16 +9641,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6403,15 +9673,30 @@
     "description": "Triggered when you accept a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6420,15 +9705,30 @@
     "description": "Triggered when you cancel a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6437,15 +9737,30 @@
     "description": "Triggered when you create a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6454,15 +9769,30 @@
     "description": "Triggered when you decline a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6471,15 +9801,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6487,15 +9832,30 @@
     "description": "Triggered when you revoke a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6504,17 +9864,30 @@
     "description": "A new trusted device was added.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6522,17 +9895,30 @@
     "description": "A trusted device was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6540,14 +9926,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "action",
-      "request_id",
-      "user_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -6556,15 +9957,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "created_at",
-      "user_id",
-      "operation_type",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6572,13 +9988,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "created_at",
-      "user_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6586,17 +10019,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "operation_type",
-      "action",
-      "_document_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6604,17 +10050,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6622,32 +10081,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "created_at",
-      "user_id",
-      "action",
       "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "two_factor_account_recovery.two_factor_destroy",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "two_factor_account_recovery.two_factor_destroy",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "user",
       "_document_id",
-      "request_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6655,18 +10143,30 @@
     "description": "A secondary authentication factor was added to a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -6675,18 +10175,30 @@
     "description": "Two-factor authentication was disabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
     "fields": [
-      "actor",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_id",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Disabling two-factor authentication for your personal account"
   },
@@ -6695,18 +10207,30 @@
     "description": "Two-factor authentication was enabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
-      "actor",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Configuring two-factor authentication"
   },
@@ -6715,15 +10239,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user",
-      "user_id",
-      "action",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "user_agent"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6731,16 +10270,29 @@
     "description": "Two factor recovery codes were regenerated for a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
+      "operation_type",
       "created_at"
     ]
   },
@@ -6749,18 +10301,30 @@
     "description": "A secondary authentication factor was removed from a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -6769,15 +10333,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "created_at",
-      "_document_id",
-      "action",
-      "@timestamp"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6786,16 +10365,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "operation_type",
       "user_agent",
-      "action",
-      "request_id",
-      "actor",
-      "actor_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6803,19 +10395,31 @@
     "description": "An email address was added to a user account.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
     "fields": [
-      "action",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "actor_id",
-      "actor",
       "email",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding an email address to your GitHub account"
   },
@@ -6824,18 +10428,30 @@
     "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "created_at",
-      "user",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6843,15 +10459,28 @@
     "description": "Audit log entries were exported.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "action",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ]
@@ -6861,20 +10490,31 @@
     "description": "A user was blocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_id",
-      "_document_id",
       "actor_id",
-      "@timestamp",
-      "user_agent",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6882,18 +10522,30 @@
     "description": "A user changed their password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "actor_id",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6901,18 +10553,30 @@
     "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -6921,17 +10585,30 @@
     "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -6940,19 +10617,31 @@
     "description": "A new user account was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "email",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "created_at",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "programmatic_access_type"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "email",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6960,21 +10649,33 @@
     "description": "A user secret for Codespaces was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6982,39 +10683,62 @@
     "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "oauth_application_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "@timestamp",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
+    ]
+  },
   {
     "action": "user.delete",
     "description": "A user account was destroyed by an asynchronous job.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7023,19 +10747,30 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "oauth_application_id",
+      "_document_id",
       "action",
-      "user",
-      "created_at",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7043,18 +10778,30 @@
     "description": "A user deleted his or her account, triggering user.async_delete.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
-      "created_at",
-      "user_agent",
       "user_id",
-      "operation_type",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7062,18 +10809,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "user_agent",
       "user_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7081,18 +10840,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "_document_id",
-      "@timestamp",
-      "user",
-      "actor_id",
-      "action",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7101,17 +10872,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "request_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7119,17 +10902,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7137,17 +10933,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7155,17 +10964,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7173,21 +10995,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -7195,21 +11027,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -7218,17 +11060,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7236,17 +11091,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7254,17 +11122,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7272,18 +11153,30 @@
     "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "org_id",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7291,17 +11184,31 @@
     "description": "A user requested a password reset.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
     "fields": [
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "email",
-      "created_at",
-      "user_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
   },
@@ -7310,17 +11217,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "created_at",
-      "user_agent",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "request_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7328,18 +11248,30 @@
     "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -7348,19 +11280,31 @@
     "description": "A user signed in.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "actor_id",
       "@timestamp",
-      "user",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "actor",
-      "passkey_nickname",
-      "request_access_security_header"
+      "passkey_nickname"
     ]
   },
   {
@@ -7368,18 +11312,30 @@
     "description": "A user signed out.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7387,18 +11343,30 @@
     "description": "A user signed in from a new device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7406,21 +11374,31 @@
     "description": "An ordinary user account was promoted to a site administrator.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
+      "user_id",
       "user_agent",
+      "created_at",
       "oauth_application_id",
-      "request_id",
-      "operation_type",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7428,16 +11406,29 @@
     "description": "A user's account was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user",
-      "action",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "operation_type"
     ]
   },
@@ -7446,20 +11437,31 @@
     "description": "An email address was removed from a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "actor_id",
       "created_at",
-      "email",
-      "token_scopes",
-      "programmatic_access_type"
+      "email"
     ]
   },
   {
@@ -7467,20 +11469,32 @@
     "description": "A user secret for Codespaces was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "key",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7488,20 +11502,31 @@
     "description": "A username was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "request_id",
-      "actor_id",
-      "old_login",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_login",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7509,18 +11534,30 @@
     "description": "A user reset their account password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7528,16 +11565,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -7548,16 +11598,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -7566,18 +11628,30 @@
     "description": "A user signed in from an unrecognized device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user",
-      "user_id",
-      "operation_type",
-      "created_at",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7585,18 +11659,30 @@
     "description": "A user signed in from an unrecognized device and location.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "created_at",
-      "_document_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7604,22 +11690,33 @@
     "description": "Triggered when you clear the status on your profile.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "message",
-      "user",
-      "actor_id",
       "created_at",
-      "request_id",
       "limited_availability",
-      "action",
       "emoji",
-      "operation_type",
-      "user_agent",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7627,23 +11724,33 @@
     "description": "Triggered when you set or change the status on your profile.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
     "fields": [
-      "limited_availability",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "message",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "limited_availability",
+      "message",
+      "created_at",
       "emoji",
-      "org",
-      "actor",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
   },
@@ -7652,21 +11759,31 @@
     "description": "A user account was suspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "user_agent",
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "token_scopes",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7674,18 +11791,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
-      "actor_id",
       "@timestamp",
-      "operation_type",
       "_document_id",
-      "user_agent",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7693,18 +11822,30 @@
     "description": "A 2FA challenge issued for a user account failed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "actor_id",
-      "actor",
-      "user_id",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7714,16 +11855,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
       "user_agent",
-      "request_id",
-      "action",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7731,18 +11884,30 @@
     "description": "A user used their 2FA recovery codes.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7750,18 +11915,30 @@
     "description": "A user downloaded 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7769,17 +11946,30 @@
     "description": "A user printed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7787,18 +11977,30 @@
     "description": "A user viewed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
       "created_at",
-      "user",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7806,17 +12008,30 @@
     "description": "A user was prompted for a two-factor authentication code.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
     "fields": [
-      "user",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "actor"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
   },
@@ -7825,19 +12040,31 @@
     "description": "A user was unblocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "user_agent",
-      "user_id",
-      "user",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7845,21 +12072,31 @@
     "description": "A user account was unsuspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "user_agent",
       "actor",
-      "oauth_application_id",
-      "operation_type",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "user_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7867,21 +12104,33 @@
     "description": "A user secret for Codespaces was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7889,46 +12138,64 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "workflows.approve_workflow_job",
+    "description": "A workflow job was approved.",
+    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "workflows.approve_workflow_job",
-    "description": "A workflow job was approved.",
-    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
-    "fields": [
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "workflow_run_id",
       "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -7937,23 +12204,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7961,23 +12238,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -7987,23 +12272,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -8012,22 +12309,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8035,21 +12343,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -8057,25 +12376,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8083,24 +12410,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -8109,25 +12445,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.15/enterprise.json b/src/audit-logs/data/ghes-3.15/enterprise.json
index 9f24bc326ce9..eb46d115068d 100644
--- a/src/audit-logs/data/ghes-3.15/enterprise.json
+++ b/src/audit-logs/data/ghes-3.15/enterprise.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,17 +67,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
-      "user_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -61,18 +98,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
+      "token_scopes",
       "user",
-      "request_id",
-      "_document_id",
-      "user_agent",
-      "actor",
       "user_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -80,18 +129,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "token_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -99,29 +160,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -129,31 +196,34 @@
     "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "query_string",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "request_body",
-      "status_code",
-      "url_path",
       "business",
       "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "request_method",
+      "query_string",
+      "request_body",
+      "status_code",
+      "url_path",
+      "public_repo",
       "created_at",
       "operation_type",
       "route",
@@ -167,18 +237,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -186,20 +268,32 @@
     "description": "A manual check of the endpoint configured for audit log streaming was performed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "audit_log_stream_result",
-      "business_id",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_result",
       "created_at",
       "operation_type",
-      "audit_log_stream_sink_details",
-      "request_access_security_header"
+      "audit_log_stream_sink_details"
     ]
   },
   {
@@ -207,18 +301,31 @@
     "description": "An endpoint was added for audit log streaming.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "business_id",
       "business",
-      "audit_log_stream_sink",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_sink",
+      "created_at",
+      "operation_type",
       "audit_log_stream_id"
     ]
   },
@@ -227,15 +334,28 @@
     "description": "An audit log streaming endpoint was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "business_id",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "audit_log_stream_id",
@@ -247,17 +367,30 @@
     "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "audit_log_stream_enabled",
-      "business_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_enabled",
       "audit_log_stream_sink",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "new_s3_bucket",
@@ -280,17 +413,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -299,19 +445,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -320,18 +478,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -339,18 +510,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -358,15 +541,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -376,22 +572,31 @@
     "description": "An enterprise owner was added to an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
     "fields": [
-      "name",
-      "business",
-      "user",
-      "user_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "request_id",
+      "business",
       "business_id",
-      "_document_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Inviting people to manage your enterprise"
   },
@@ -400,22 +605,32 @@
     "description": "An organization was added to an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "operation_type",
       "name",
       "created_at",
-      "request_id",
-      "_document_id",
-      "business",
-      "organization_upgrade",
-      "request_access_security_header"
+      "organization_upgrade"
     ]
   },
   {
@@ -423,20 +638,30 @@
     "description": "GitHub Advanced Security was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -445,17 +670,28 @@
     "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -466,21 +702,31 @@
     "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -489,17 +735,28 @@
     "description": "GitHub Advanced Security was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -510,17 +767,28 @@
     "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -531,21 +799,31 @@
     "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -554,20 +832,32 @@
     "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "new_policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "new_policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -576,20 +866,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -597,17 +899,28 @@
     "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -619,21 +932,31 @@
     "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -642,18 +965,31 @@
     "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -662,17 +998,30 @@
     "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
     "fields": [
-      "name",
-      "operation_type",
-      "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "actor",
+      "@timestamp",
       "_document_id",
-      "business",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -682,19 +1031,32 @@
     "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
-      "action",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "business",
       "visibility",
       "created_at",
-      "actor",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -703,21 +1065,33 @@
     "description": "The policy for Code scanning autofix was updated for an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -725,19 +1099,31 @@
     "description": "An enterprise was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "request_id",
-      "name",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "operation_type",
-      "actor",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -745,17 +1131,28 @@
     "description": "Dependabot alerts were disabled for new repositories in your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -765,17 +1162,28 @@
     "description": "Dependabot alerts were enabled for new repositories in your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -785,17 +1193,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -805,18 +1226,30 @@
     "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -824,17 +1257,28 @@
     "description": "Display of IP addresses within audit log events for the enterprise was disabled.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -845,18 +1289,31 @@
     "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "business_id",
-      "actor_id",
-      "name",
-      "_document_id",
-      "request_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ]
   },
   {
@@ -864,15 +1321,28 @@
     "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -882,17 +1352,28 @@
     "description": "Display of IP addresses within audit log events for the enterprise was enabled.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -903,18 +1384,31 @@
     "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "operation_type",
-      "created_at",
+      "actor_id",
       "business",
       "business_id",
-      "name",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ]
   },
   {
@@ -922,20 +1416,31 @@
     "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
       "business",
-      "name",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "business_id",
-      "_document_id"
+      "created_at",
+      "name",
+      "operation_type"
     ]
   },
   {
@@ -943,20 +1448,31 @@
     "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -964,20 +1480,31 @@
     "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "business",
-      "actor_id",
-      "created_at",
-      "action",
+      "user_id",
       "user_agent",
-      "request_id",
-      "user_id"
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -985,20 +1512,31 @@
     "description": "An enterprise owner was removed from an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
-      "user_agent",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "name",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
-      "user"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ],
     "docs_reference_titles": "Inviting people to manage your enterprise"
   },
@@ -1007,20 +1545,31 @@
     "description": "An organization was removed from an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "business",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "business_id",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "name",
-      "org"
+      "name"
     ]
   },
   {
@@ -1028,18 +1577,31 @@
     "description": "The slug for the enterprise URL was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "name",
-      "business_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
-      "@timestamp",
-      "created_at",
+      "actor_id",
       "business",
-      "_document_id"
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1047,20 +1609,31 @@
     "description": "The SAML single sign-on session for a member in an enterprise was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "_document_id",
-      "actor_id",
       "name",
-      "@timestamp",
-      "user_id",
-      "action",
-      "created_at",
-      "business"
+      "created_at"
     ]
   },
   {
@@ -1068,17 +1641,28 @@
     "description": "Automatic partner validation checks have been disabled at the business level",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1089,17 +1673,28 @@
     "description": "Automatic partner validation checks have been enabled at the business level",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1110,20 +1705,30 @@
     "description": "An enterprise-level custom pattern was created for secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -1132,17 +1737,28 @@
     "description": "An enterprise-level custom pattern was removed from secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1152,20 +1768,30 @@
     "description": "An enterprise-level custom pattern was published for secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1173,17 +1799,28 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1194,20 +1831,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -1216,17 +1863,28 @@
     "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1236,17 +1894,28 @@
     "description": "Secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1257,17 +1926,28 @@
     "description": "Secret scanning was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1278,17 +1958,28 @@
     "description": "Secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1299,17 +1990,28 @@
     "description": "Secret scanning was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1320,17 +2022,28 @@
     "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1342,17 +2055,28 @@
     "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1364,17 +2088,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1385,17 +2120,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1406,17 +2152,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1427,17 +2184,28 @@
     "description": "Push protection for secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1448,17 +2216,28 @@
     "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1469,17 +2248,28 @@
     "description": "Push protection for secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1490,17 +2280,28 @@
     "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1511,20 +2312,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1532,17 +2345,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -1553,20 +2379,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1575,19 +2413,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1596,19 +2447,31 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1617,20 +2480,32 @@
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1639,19 +2514,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1660,20 +2547,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "issuer",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
       "business_id",
-      "actor_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "issuer",
+      "name",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1681,46 +2580,72 @@
     "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "updated_github_owned_allowed",
-      "updated_verified_allowed",
-      "updated_patterns",
-      "new_policy",
-      "old_policy",
-      "updated_access_policy"
-    ],
-    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
-  },
-  {
-    "action": "business.update_default_repository_permission",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "updated_github_owned_allowed",
+      "updated_verified_allowed",
+      "updated_patterns",
+      "new_policy",
+      "old_policy",
+      "updated_access_policy"
+    ],
+    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+  },
+  {
+    "action": "business.update_default_repository_permission",
     "description": "The base repository permission setting was updated for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
     "fields": [
-      "business_id",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "permission",
-      "action",
       "created_at",
-      "@timestamp",
-      "request_id",
       "name",
-      "_document_id",
-      "old_permission",
-      "business"
+      "old_permission"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -1729,19 +2654,32 @@
     "description": "The repository creation setting was updated for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "name",
-      "business_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "operation_type",
-      "permission",
-      "action",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "name",
+      "operation_type",
+      "permission",
       "visibility"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -1751,19 +2689,32 @@
     "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories",
     "fields": [
-      "business_id",
-      "created_at",
-      "action",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "permission",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "business"
+      "created_at",
+      "operation_type",
+      "permission",
+      "name"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -1772,20 +2723,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -1794,20 +2756,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -1818,17 +2791,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1836,14 +2821,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1853,25 +2853,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -1882,22 +2891,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
-      "repository",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -1909,22 +2929,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -1933,15 +2964,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -1952,17 +2998,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1972,27 +3031,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "org",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2000,19 +3068,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -2020,18 +3101,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -2040,23 +3133,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2064,16 +3164,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -2082,40 +3196,59 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "request_access_security_header"
-    ]
-  },
-  {
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
     "action": "copilot.cfb_seat_assignment_reused",
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2125,20 +3258,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2146,19 +3289,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -2166,21 +3321,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -2188,21 +3352,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2212,19 +3385,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2234,21 +3416,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2258,18 +3449,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -2282,18 +3486,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -2307,14 +3524,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -2327,8 +3559,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2337,27 +3568,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2366,19 +3605,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2387,16 +3638,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "definition_id"
@@ -2408,19 +3672,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -2429,19 +3704,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -2450,19 +3736,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -2471,19 +3768,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -2492,17 +3800,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2510,40 +3831,62 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
-  },
-  {
-    "action": "dependabot_security_updates.enable",
-    "description": "Dependabot security updates were enabled for all existing repositories.",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+  },
+  {
+    "action": "dependabot_security_updates.enable",
+    "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2551,19 +3894,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -2572,19 +3926,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2592,19 +3957,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -2613,19 +3989,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2633,19 +4020,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -2654,20 +4052,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2675,21 +4083,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "team",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "number",
-      "org",
-      "title",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id"
+      "team",
+      "created_at",
+      "number",
+      "title",
+      "operation_type"
     ]
   },
   {
@@ -2697,18 +4117,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user_id",
-      "actor",
       "number",
-      "user",
-      "created_at",
-      "request_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2716,18 +4149,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "_document_id",
-      "request_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "number",
       "team",
       "created_at"
@@ -2738,21 +4182,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "_document_id",
-      "title",
-      "user",
-      "user_agent",
-      "org",
-      "operation_type",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "team",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type",
+      "team",
       "number"
     ]
   },
@@ -2761,17 +4216,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2782,16 +4251,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2802,18 +4285,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
       "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2824,23 +4321,31 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise"
   },
@@ -2849,19 +4354,33 @@
     "description": "A domain was approved for an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -2870,18 +4389,33 @@
     "description": "A domain was added to an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -2890,18 +4424,33 @@
     "description": "A domain was removed from an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -2910,18 +4459,33 @@
     "description": "A domain was verified for an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -2930,18 +4494,30 @@
     "description": "A new GitHub Actions self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -2950,20 +4526,30 @@
     "description": "A GitHub Actions self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -2972,18 +4558,31 @@
     "description": "A GitHub Actions self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
@@ -2993,18 +4592,31 @@
     "description": "A GitHub Actions self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3013,20 +4625,33 @@
     "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -3035,19 +4660,31 @@
     "description": "A GitHub Actions self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3056,19 +4693,32 @@
     "description": "A GitHub Actions runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -3077,24 +4727,36 @@
     "description": "The configuration of a GitHub Actions self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3103,14 +4765,32 @@
     "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -3119,14 +4799,32 @@
     "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -3135,18 +4833,36 @@
     "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
       "target_version",
       "runner_group_id",
       "runner_group_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Self-hosted runners"
   },
@@ -3155,22 +4871,32 @@
     "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "business_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "user",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3178,21 +4904,33 @@
     "description": "A license for GitHub Copilot was assigned to an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3200,17 +4938,30 @@
     "description": "A license for GitHub Copilot was unassigned from an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3221,17 +4972,30 @@
     "description": "A new enterprise team was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3241,17 +5005,30 @@
     "description": "An enterprise team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3262,22 +5039,32 @@
     "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "business_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "user",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3285,18 +5072,31 @@
     "description": "The name of an enterprise team was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "business_id",
-      "enterprise_team_id",
-      "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "enterprise_team_id",
+      "enterprise_team",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3307,22 +5107,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3331,22 +5140,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3354,28 +5173,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3384,27 +5209,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -3413,25 +5246,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3440,26 +5281,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3468,21 +5316,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -3491,22 +5351,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3515,25 +5385,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3542,22 +5421,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -3566,21 +5457,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -3591,27 +5492,33 @@
     "description": "A user was added to an external group.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "external_group",
-      "external_group_id",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "external_group",
+      "external_group_id",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -3619,19 +5526,31 @@
     "description": "An external group was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at",
       "scim_group_id"
     ]
   },
@@ -3640,22 +5559,33 @@
     "description": "An external group was linked to a GitHub team.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "external_group",
-      "programmatic_access_type",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -3663,21 +5593,31 @@
     "description": "An external group was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3685,26 +5625,32 @@
     "description": "A user was removed from an external group.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "external_group",
-      "external_group_id",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "external_group",
+      "external_group_id",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3712,31 +5658,39 @@
     "description": "Failed external group SCIM API request.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_group_id",
-      "message",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "message",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -3745,30 +5699,38 @@
     "description": "Successful external group SCIM API request. Excludes GET API requests.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -3777,18 +5739,31 @@
     "description": "An external group was unlinked to a GitHub team.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "external_group"
     ]
   },
@@ -3797,22 +5772,32 @@
     "description": "An external group was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "scim_group_id",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at",
+      "scim_group_id"
     ]
   },
   {
@@ -3820,25 +5805,33 @@
     "description": "An external group's display name was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
       "external_group",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -3846,20 +5839,31 @@
     "description": "An external identity was deprovisioned, suspending the linked GitHub user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -3867,17 +5871,31 @@
     "description": "An external identity was created and linked to a GitHub user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "scim_user_id",
-      "request_access_security_header"
+      "scim_user_id"
     ]
   },
   {
@@ -3885,15 +5903,29 @@
     "description": "Failed external identity SCIM API request.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
@@ -3901,15 +5933,9 @@
       "url_path",
       "scim_user_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -3918,30 +5944,38 @@
     "description": "Successful external identity SCIM API request. Excludes GET API requests.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -3950,18 +5984,31 @@
     "description": "An external identity was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "scim_user_id",
-      "request_access_security_header"
+      "scim_user_id"
     ]
   },
   {
@@ -3969,21 +6016,32 @@
     "description": "A gist was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "gist_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "visibility",
-      "action",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ]
   },
   {
@@ -3991,20 +6049,32 @@
     "description": "A gist was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "gist_id",
-      "visibility",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "user",
-      "request_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "programmatic_access_type"
+      "gist_id",
+      "visibility",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4012,21 +6082,32 @@
     "description": "The visibility of a gist was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "user",
-      "gist_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "visibility",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "gist_id",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -4034,19 +6115,30 @@
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4055,20 +6147,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4077,19 +6179,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4098,22 +6211,33 @@
     "description": "An SSH key was added to a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -4122,48 +6246,68 @@
     "description": "An SSH key was removed from a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
       "explanation",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
+  },
+  {
+    "action": "github_hosted_runner.create",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
-  },
-  {
-    "action": "github_hosted_runner.create",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "actor",
-      "actor_id",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "name",
       "runner_group_id",
-      "business",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4171,18 +6315,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4193,20 +6347,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -4216,18 +6380,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "user",
-      "operation_type",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4235,18 +6411,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4254,25 +6442,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -4280,25 +6478,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -4306,26 +6513,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -4334,25 +6550,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
-      "repo",
-      "created_at",
-      "org",
-      "name",
-      "request_id",
       "actor_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
+      "created_at",
+      "name",
+      "operation_type",
+      "oauth_application_id",
+      "hook_id"
     ]
   },
   {
@@ -4360,26 +6585,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -4387,21 +6621,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -4410,19 +6655,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -4430,21 +6688,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -4453,19 +6722,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -4476,20 +6759,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -4499,24 +6794,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -4527,23 +6833,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -4554,20 +6872,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -4577,19 +6908,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -4598,20 +6943,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -4621,20 +6979,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -4643,20 +7014,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -4665,20 +7049,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -4686,19 +7082,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -4707,19 +7116,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -4728,44 +7150,70 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
+      "created_at",
+      "operation_type",
+      "application_client_id"
+    ],
+    "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
+  },
+  {
+    "action": "integration.transfer",
+    "description": "Ownership of a GitHub App was transferred to another user or organization.",
+    "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "application_client_id"
-    ],
-    "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
-  },
-  {
-    "action": "integration.transfer",
-    "description": "Ownership of a GitHub App was transferred to another user or organization.",
-    "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
-    "fields": [
-      "@timestamp",
-      "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -4779,17 +7227,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -4801,19 +7262,30 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "user"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4821,19 +7293,30 @@
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4841,17 +7324,28 @@
     "description": "IP allow list user level enforcement was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4861,20 +7355,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "user_id",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
-      "_document_id",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "actor_id",
       "operation_type",
-      "org",
       "created_at"
     ]
   },
@@ -4883,19 +7386,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4903,17 +7417,28 @@
     "description": "IP allow list user level enforcement was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4923,24 +7448,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4948,24 +7481,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ip_allow_list_entry",
-      "org",
       "operation_type",
       "created_at",
-      "active",
-      "action",
-      "@timestamp",
-      "business",
-      "business_id",
-      "user_agent",
-      "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "active"
     ]
   },
   {
@@ -4973,19 +7514,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "actor_id",
       "ip_allow_list_entry",
-      "active",
-      "org_id",
-      "@timestamp"
+      "active"
     ]
   },
   {
@@ -4993,18 +7547,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5012,21 +7578,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -5034,21 +7613,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5056,22 +7648,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -5079,19 +7684,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -5102,21 +7720,36 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
       "marketplace_listing",
       "has_free_trial",
-      "user_agent",
-      "request_id",
-      "actor_id",
       "yearly_price_in_cents",
       "description",
       "bullets",
       "monthly_price_in_cents",
-      "marketplace_listing_plan",
-      "_document_id"
+      "marketplace_listing_plan"
     ]
   },
   {
@@ -5124,22 +7757,37 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "marketplace_listing_plan",
       "marketplace_listing",
       "description",
       "bullets",
       "has_free_trial",
       "created_at",
-      "actor_id",
       "operation_type",
-      "_document_id",
-      "action",
-      "user_agent",
-      "request_id",
-      "actor",
       "monthly_price_in_cents",
-      "yearly_price_in_cents",
-      "@timestamp"
+      "yearly_price_in_cents"
     ]
   },
   {
@@ -5147,21 +7795,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "marketplace_listing_plan",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "marketplace_listing_plan",
       "description",
       "yearly_price_in_cents",
-      "@timestamp",
       "created_at",
-      "actor_id",
       "bullets",
       "has_free_trial",
       "marketplace_listing",
-      "user_agent",
       "monthly_price_in_cents",
-      "action",
       "operation_type"
     ]
   },
@@ -5170,21 +7833,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "monthly_price_in_cents",
-      "marketplace_listing",
+      "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "monthly_price_in_cents",
+      "marketplace_listing",
       "description",
       "bullets",
       "yearly_price_in_cents",
-      "request_id",
-      "actor_id",
       "has_free_trial",
       "marketplace_listing_plan",
-      "user_agent",
-      "@timestamp",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -5193,22 +7871,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -5216,22 +7907,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5239,19 +7943,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5259,21 +7975,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5283,16 +8008,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5302,18 +8040,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5323,14 +8074,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5338,19 +8105,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -5358,18 +8136,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5377,23 +8167,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -5401,20 +8199,30 @@
     "description": "An OAuth access token was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
     "fields": [
-      "_document_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "user",
-      "user_id",
-      "created_at",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "request_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
@@ -5425,19 +8233,30 @@
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "explanation",
-      "hashed_token",
-      "actor_id",
-      "token_scopes",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
@@ -5447,19 +8266,30 @@
     "description": "An OAuth access token was regenerated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "_document_id",
-      "created_at",
       "@timestamp",
-      "operation_type",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ]
   },
@@ -5468,18 +8298,30 @@
     "description": "An OAuth access token was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5487,20 +8329,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5509,20 +8363,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5531,20 +8397,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5553,20 +8431,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5575,19 +8465,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5596,20 +8499,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5618,20 +8533,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5641,18 +8568,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "org_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "oauth_application_id",
-      "action",
       "created_at",
-      "actor",
-      "actor_id",
-      "oauth_application",
-      "_document_id",
-      "request_id"
+      "oauth_application"
     ]
   },
   {
@@ -5660,19 +8600,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5681,15 +8634,32 @@
     "description": "An OAuth application was unsuspended for a user or organization account.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "operation_type",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "oauth_application_id",
       "oauth_application",
-      "org",
-      "created_at",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5698,24 +8668,31 @@
     "description": "An authorization for an OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "user_id",
-      "actor",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
       "actor_id",
-      "user",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "actor_is_bot",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -5725,20 +8702,31 @@
     "description": "An authorization for an OAuth application was deleted.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "actor",
       "created_at",
       "explanation",
-      "user",
-      "user_id",
-      "org_id",
-      "action",
-      "actor_id",
-      "token_scopes",
       "actor_is_bot",
       "oauth_application_name"
     ],
@@ -5749,20 +8737,31 @@
     "description": "An authorization for an OAuth application was updated.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
-      "actor_id",
       "user_agent",
-      "@timestamp",
       "operation_type",
-      "action",
-      "user",
       "created_at",
-      "_document_id",
       "actor_is_bot",
-      "request_access_security_header",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -5772,17 +8771,28 @@
     "description": "An invitation sent to an organization to join an enterprise was accepted.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5793,20 +8803,30 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
   },
@@ -5815,21 +8835,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -5838,24 +8868,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5863,21 +8903,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -5885,20 +8935,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5906,22 +8966,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5929,20 +8997,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5950,22 +9028,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5973,19 +9059,30 @@
     "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -5994,19 +9091,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -6016,16 +9124,29 @@
     "description": "A user initiated a background job to delete an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ]
   },
@@ -6034,16 +9155,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -6052,18 +9186,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
-      "actor",
-      "user_agent",
-      "org_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "blocked_user",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -6072,19 +9219,30 @@
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -6094,22 +9252,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "email",
-      "@timestamp",
-      "actor",
-      "action",
       "operation_type",
-      "user_agent",
-      "org",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -6117,19 +9286,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -6137,23 +9317,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6161,21 +9349,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6183,21 +9381,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -6206,21 +9413,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -6229,16 +9445,29 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
@@ -6248,17 +9477,30 @@
     "description": "The interaction limit for prior contributors only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6267,17 +9509,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6287,16 +9542,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6305,17 +9573,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6324,17 +9605,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6343,22 +9637,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -6367,17 +9669,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6388,18 +9701,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
-      "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -6408,18 +9733,30 @@
     "description": "An organization was deleted by a user or staff.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "org_id",
-      "org",
       "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6427,20 +9764,30 @@
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -6449,19 +9796,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -6470,14 +9828,31 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sso_url",
       "issuer",
-      "action",
-      "@timestamp",
-      "_document_id",
       "created_at",
-      "org",
       "operation_type"
     ]
   },
@@ -6486,17 +9861,30 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6504,19 +9892,30 @@
     "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6524,19 +9923,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
-      "action",
-      "actor_id",
-      "org_id"
+      "created_at"
     ]
   },
   {
@@ -6544,19 +9954,30 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -6565,19 +9986,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "created_at",
-      "org",
-      "org_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -6586,19 +10018,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "sso_url",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "issuer",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "sso_url",
+      "created_at",
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -6607,17 +10052,30 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
   },
@@ -6626,17 +10084,30 @@
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -6645,18 +10116,31 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
-      "org",
-      "user_agent",
-      "request_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "manager",
       "operation_type",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6664,23 +10148,32 @@
     "description": "A new user was invited to join an organization.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
     "fields": [
-      "org",
-      "user_id",
-      "invitation_id",
-      "org_id",
-      "user",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -6689,17 +10182,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6709,19 +10213,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6729,19 +10244,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6750,16 +10276,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6767,17 +10306,30 @@
     "description": "An organization was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6785,19 +10337,31 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -6806,18 +10370,29 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
@@ -6827,21 +10402,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6849,21 +10433,30 @@
     "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user",
-      "org_id",
-      "created_at",
-      "request_id",
       "@timestamp",
-      "action",
-      "operation_type",
-      "user_agent",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6871,21 +10464,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -6893,18 +10496,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -6913,19 +10528,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
-      "old_login",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_login",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6933,20 +10560,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -6955,21 +10592,33 @@
     "description": "A self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "runner_group_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -6979,21 +10628,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7002,23 +10661,33 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -7027,23 +10696,31 @@
     "description": "A self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7052,19 +10729,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -7073,25 +10763,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7100,21 +10801,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7124,21 +10834,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7148,20 +10867,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7170,22 +10899,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7194,21 +10931,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7217,21 +10963,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7240,22 +10995,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7264,21 +11027,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7287,21 +11059,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7311,21 +11092,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7335,19 +11125,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7357,21 +11158,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7381,21 +11191,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7405,19 +11224,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7427,22 +11257,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7451,22 +11289,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7475,22 +11321,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7499,21 +11353,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7522,21 +11385,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7545,22 +11417,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7569,22 +11449,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7593,26 +11481,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7620,28 +11516,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7649,26 +11553,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7676,15 +11588,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7693,15 +11622,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7710,7 +11656,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -7725,20 +11692,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -7747,16 +11725,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -7767,18 +11758,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -7787,17 +11791,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7805,18 +11822,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -7825,18 +11854,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "policy",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -7845,18 +11887,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -7865,22 +11919,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issuer",
-      "business",
       "operation_type",
       "created_at",
-      "request_id",
-      "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7888,19 +11952,31 @@
     "description": "A user account was converted into an organization.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization",
     "fields": [
-      "actor",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "@timestamp",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "owner",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "owner"
     ],
     "docs_reference_titles": "Converting a user into an organization"
   },
@@ -7909,19 +11985,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
-      "oauth_application_id",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "blocked_user",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -7930,23 +12019,34 @@
     "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -7955,20 +12055,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -7977,20 +12089,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -7998,17 +12121,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -8018,41 +12154,65 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
   {
     "action": "org.update_saml_provider_settings",
-    "description": "An organization's SAML provider settings were updated.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
+    "description": "An organization's SAML provider settings were updated.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "issuer",
-      "org",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -8060,18 +12220,30 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "org",
-      "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
@@ -8080,20 +12252,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "org_id",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -8102,16 +12287,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8120,14 +12320,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -8138,16 +12353,31 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "operation_type",
-      "domain_name",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
       "_document_id",
-      "actor_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "domain_name",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8156,20 +12386,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -8179,23 +12420,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8204,21 +12456,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -8229,21 +12492,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8252,20 +12528,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8274,17 +12564,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8295,20 +12600,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8317,19 +12636,31 @@
     "description": "A new passkey was added.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8337,19 +12668,31 @@
     "description": "A new passkey was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8357,18 +12700,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8376,16 +12731,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8393,18 +12762,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8412,18 +12793,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8434,18 +12828,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8456,17 +12863,30 @@
     "description": "Triggered when you create a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8476,19 +12896,31 @@
     "description": "Triggered when you regenerate a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8496,12 +12928,29 @@
     "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
     "fields": [
-      "user_programmatic_access_name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
       "operation_type"
     ],
@@ -8512,20 +12961,32 @@
     "description": "Triggered when you delete a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "explanation",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8533,17 +12994,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8554,18 +13028,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8577,17 +13064,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8599,17 +13099,30 @@
     "description": "A fine-grained personal access token was updated.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8620,15 +13133,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8638,17 +13166,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8658,15 +13197,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8676,17 +13230,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8696,17 +13261,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8716,17 +13292,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8736,17 +13323,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8756,17 +13354,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -8776,17 +13387,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8794,20 +13418,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -8817,25 +13452,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -8843,20 +13490,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8864,25 +13523,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8890,17 +13561,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8908,17 +13592,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8926,18 +13623,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -8946,18 +13655,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -8966,19 +13687,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -8986,17 +13718,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -9008,22 +13753,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -9031,19 +13785,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9051,17 +13816,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9069,18 +13847,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -9088,20 +13879,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9109,18 +13910,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -9129,18 +13942,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -9149,16 +13974,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -9170,21 +14008,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -9192,22 +14042,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -9216,29 +14076,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9246,24 +14111,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
       "user_agent",
-      "repo",
+      "operation_type",
       "name",
-      "org_id",
-      "user",
-      "_document_id",
-      "request_id",
-      "actor",
-      "actor_id",
-      "org",
-      "action",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -9274,21 +14147,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -9299,22 +14182,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -9322,24 +14215,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "authorized_actors_only",
       "authorized_actors",
       "created_at",
-      "user_agent",
       "name",
-      "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
-      "actor_id",
-      "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -9347,30 +14250,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -9380,28 +14290,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -9412,23 +14330,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -9436,22 +14363,32 @@
     "description": "Branch deletion was enabled or disabled for a protected branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "operation_type",
-      "request_id",
-      "repo",
       "@timestamp",
-      "org_id",
-      "org",
-      "action",
-      "allow_deletions_enforcement_level",
       "_document_id",
-      "created_at",
-      "actor_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_deletions_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -9459,23 +14396,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "_document_id",
-      "actor",
-      "repo",
       "operation_type",
-      "request_id",
       "allow_force_pushes_enforcement_level",
-      "@timestamp",
-      "org",
-      "action",
-      "created_at",
-      "user_agent",
-      "repo_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -9483,24 +14429,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -9509,22 +14464,32 @@
     "description": "Required linear commit history was enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "operation_type",
       "actor",
-      "linear_history_requirement_enforcement_level",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "linear_history_requirement_enforcement_level",
       "name",
-      "org_id",
-      "repo_id",
-      "org",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -9532,24 +14497,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "lock_allows_fetch_and_merge",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -9558,27 +14532,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -9587,18 +14568,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9609,24 +14603,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -9634,25 +14637,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9660,22 +14670,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -9683,22 +14703,33 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
   },
@@ -9707,22 +14738,32 @@
     "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "required_approving_review_count",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -9730,25 +14771,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
     ]
   },
   {
@@ -9756,22 +14804,32 @@
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
       "action",
       "actor",
       "actor_id",
-      "signature_requirement_enforcement_level",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "programmatic_access_type"
+      "operation_type",
+      "name",
+      "created_at",
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -9779,22 +14837,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "created_at",
-      "repo_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "name",
-      "actor",
-      "repo",
       "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
+      "strict_required_status_checks_policy"
     ]
   },
   {
@@ -9802,23 +14870,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -9827,24 +14906,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -9853,20 +14943,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -9875,21 +14979,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "_document_id",
       "title",
-      "request_id",
       "key",
-      "action",
-      "actor",
       "read_only",
       "explanation",
-      "repo_id",
-      "@timestamp",
-      "actor_id",
-      "repo",
-      "user_agent",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -9899,22 +15016,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -9923,25 +15052,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -9950,23 +15089,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -9975,18 +15125,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -9996,21 +15160,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -10019,19 +15194,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -10042,23 +15230,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -10068,17 +15268,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -10086,19 +15300,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -10106,19 +15333,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -10128,21 +15368,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -10151,27 +15402,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "pull_request_url",
       "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10179,23 +15437,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -10204,18 +15474,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -10223,19 +15507,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -10245,20 +15541,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
-      "repo",
-      "created_at",
-      "request_id",
-      "comment_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "comment_id",
+      "operation_type"
     ]
   },
   {
@@ -10266,40 +15573,65 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "comment_id"
+    ]
+  },
+  {
+    "action": "pull_request_review.delete",
+    "description": "A review on a pull request was deleted.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "comment_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "pull_request_review.delete",
-    "description": "A review on a pull request was deleted.",
-    "docs_reference_links": "N/A",
-    "fields": [
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -10307,20 +15639,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -10329,19 +15674,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -10351,22 +15710,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -10375,21 +15744,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -10398,25 +15776,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -10425,23 +15810,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -10450,24 +15843,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -10476,23 +15876,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -10502,22 +15910,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -10526,19 +15943,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -10547,24 +15977,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -10573,24 +16013,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -10598,24 +16046,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -10623,23 +16079,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -10650,25 +16115,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -10677,26 +16148,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -10705,25 +16184,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "query_suite",
       "threat_model",
       "languages",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -10733,20 +16221,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "visibility",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -10754,17 +16253,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -10773,15 +16285,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -10792,16 +16317,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -10811,17 +16349,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -10831,19 +16382,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -10852,17 +16414,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -10871,26 +16446,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -10899,30 +16480,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -10932,20 +16518,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -10954,25 +16551,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -10981,23 +16586,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11005,25 +16621,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -11033,17 +16658,30 @@
     "description": "A repository was archived on disk.",
     "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
-      "repo_id",
-      "actor",
       "action",
-      "user_agent"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository/archiving-repositories"
   },
@@ -11052,23 +16690,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -11078,20 +16725,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "visibility",
-      "repo_id",
-      "created_at",
-      "actor",
-      "action",
-      "@timestamp",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -11099,20 +16757,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
-      "repo_id",
-      "request_id",
-      "action",
-      "_document_id",
       "@timestamp",
-      "actor_id",
-      "created_at",
-      "user",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
       "public_repo"
     ]
   },
@@ -11121,19 +16790,30 @@
     "description": "The repository was unlocked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11141,20 +16821,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "action",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "operation_type",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "visibility",
-      "actor",
-      "user_id"
+      "visibility"
     ]
   },
   {
@@ -11162,23 +16853,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -11186,21 +16887,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11208,21 +16919,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -11230,22 +16951,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -11253,21 +16983,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -11275,20 +17015,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11296,22 +17047,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11319,18 +17079,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11338,22 +17112,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11361,21 +17145,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11383,18 +17177,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -11403,22 +17209,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -11427,24 +17242,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -11453,23 +17276,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11477,26 +17310,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -11505,21 +17343,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -11528,25 +17375,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11554,22 +17407,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -11578,20 +17441,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "visibility",
-      "operation_type",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "@timestamp",
-      "request_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -11599,19 +17473,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11619,17 +17504,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -11638,17 +17538,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -11657,7 +17572,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -11672,23 +17608,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -11698,20 +17643,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11722,21 +17678,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -11745,22 +17712,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -11769,21 +17746,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -11792,22 +17780,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -11818,16 +17816,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -11836,22 +17845,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -11861,22 +17879,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -11885,23 +17914,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11911,19 +17950,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -11931,21 +17980,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -11954,24 +18013,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "old_policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
+      "old_policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -11979,25 +18047,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12006,24 +18081,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12032,25 +18117,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12059,22 +18152,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12083,26 +18185,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12110,31 +18220,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12143,24 +18260,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -12169,24 +18292,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -12195,21 +18324,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "content_type",
-      "repo",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -12217,21 +18356,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12239,21 +18388,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -12261,20 +18421,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -12282,21 +18454,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12304,19 +18487,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -12324,31 +18520,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -12357,19 +18561,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -12377,8 +18592,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -12387,23 +18601,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -12428,26 +18651,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -12456,26 +18685,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -12484,23 +18719,30 @@
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12510,23 +18752,30 @@
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12536,24 +18785,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12563,24 +18819,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -12589,24 +18852,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12616,23 +18886,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12642,23 +18919,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -12667,22 +18952,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12690,24 +18983,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -12716,24 +19017,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -12742,19 +19051,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12763,24 +19084,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12789,24 +19118,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12815,19 +19152,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12836,26 +19185,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12864,26 +19218,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12892,18 +19251,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -12912,19 +19284,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -12933,14 +19317,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -12954,22 +19352,32 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
@@ -12978,28 +19386,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -13007,25 +19424,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13033,14 +19457,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -13057,19 +19495,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13078,19 +19527,30 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13099,20 +19559,30 @@
     "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13121,19 +19591,30 @@
     "description": "Secret scanning was enabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13142,14 +19623,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -13167,25 +19662,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13194,25 +19697,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -13222,25 +19733,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -13249,18 +19768,30 @@
     "description": "A security key was registered for an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13268,18 +19799,30 @@
     "description": "A security key was removed from an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13287,16 +19830,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -13306,18 +19862,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -13326,16 +19895,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -13346,15 +19928,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -13364,15 +19959,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -13381,17 +19991,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -13400,17 +20023,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -13419,16 +20056,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -13438,14 +20088,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -13455,17 +20120,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -13474,17 +20152,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -13493,18 +20184,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -13513,15 +20217,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -13531,16 +20249,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13548,15 +20279,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -13567,16 +20311,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -13586,17 +20343,30 @@
     "description": "Triggered when you send an email update to your sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
     "fields": [
-      "request_id",
-      "actor",
-      "action",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
   },
@@ -13605,17 +20375,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -13626,17 +20409,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -13647,18 +20443,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -13668,16 +20475,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -13687,17 +20507,30 @@
     "description": "You join the waitlist to join GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "actor_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -13706,16 +20539,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -13727,17 +20573,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -13746,19 +20605,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -13767,21 +20639,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "user",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
       "action",
-      "user_id",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "actor_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -13790,19 +20671,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -13811,20 +20703,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -13832,18 +20738,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -13851,16 +20772,31 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "domain_name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -13868,23 +20804,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13892,23 +20838,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13916,23 +20872,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13940,23 +20906,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13964,15 +20940,30 @@
     "description": "Triggered when you accept a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -13981,15 +20972,30 @@
     "description": "Triggered when you cancel a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -13998,15 +21004,30 @@
     "description": "Triggered when you create a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -14015,15 +21036,30 @@
     "description": "Triggered when you decline a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -14032,15 +21068,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14048,15 +21099,30 @@
     "description": "Triggered when you revoke a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -14065,21 +21131,31 @@
     "description": "A member of an organization was added to a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type",
-      "_document_id",
-      "org",
-      "action",
-      "actor",
-      "programmatic_access_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -14089,22 +21165,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -14113,20 +21198,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -14135,18 +21231,31 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
       "created_at",
       "operation_type",
-      "actor_id",
-      "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
@@ -14156,21 +21265,32 @@
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -14179,21 +21299,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -14202,19 +21332,31 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "team",
       "org_id",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
       "operation_type",
-      "_document_id",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -14223,19 +21365,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
       "business",
-      "action",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14243,19 +21396,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "request_id",
       "actor",
-      "org",
-      "created_at",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14263,18 +21427,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
       "@timestamp",
-      "action",
       "_document_id",
-      "user_agent",
-      "user_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -14283,22 +21458,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -14307,22 +21491,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -14332,21 +21525,31 @@
     "description": "A repository was removed from a team's control.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "org",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -14354,21 +21557,32 @@
     "description": "A team's name was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "user_agent",
-      "created_at",
-      "team",
-      "operation_type",
-      "actor_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -14377,17 +21591,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -14396,19 +21623,30 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -14417,28 +21655,37 @@
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
       "operation_type",
       "created_at",
-      "user_agent",
       "permission",
       "new_repo_permission",
       "new_repo_base_role",
       "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_repo_base_role"
     ]
   },
   {
@@ -14446,17 +21693,30 @@
     "description": "A new trusted device was added.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14464,17 +21724,30 @@
     "description": "A trusted device was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14482,14 +21755,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "action",
-      "request_id",
-      "user_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -14498,15 +21786,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "created_at",
-      "user_id",
-      "operation_type",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14514,13 +21817,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "created_at",
-      "user_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14528,17 +21848,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "operation_type",
-      "action",
-      "_document_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14546,17 +21879,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14564,16 +21910,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14581,15 +21941,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "user",
       "_document_id",
-      "request_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14597,18 +21972,30 @@
     "description": "A secondary authentication factor was added to a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -14617,18 +22004,30 @@
     "description": "Two-factor authentication was disabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
     "fields": [
-      "actor",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_id",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Disabling two-factor authentication for your personal account"
   },
@@ -14637,18 +22036,30 @@
     "description": "Two-factor authentication was enabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
-      "actor",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Configuring two-factor authentication"
   },
@@ -14657,15 +22068,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "@timestamp",
-      "request_id",
-      "_document_id",
-      "user_agent"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14673,16 +22099,29 @@
     "description": "Two factor recovery codes were regenerated for a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
+      "operation_type",
       "created_at"
     ]
   },
@@ -14691,18 +22130,30 @@
     "description": "A secondary authentication factor was removed from a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -14711,15 +22162,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "created_at",
-      "_document_id",
-      "action",
-      "@timestamp"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14728,16 +22194,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "operation_type",
       "user_agent",
-      "action",
-      "request_id",
-      "actor",
-      "actor_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14745,19 +22224,31 @@
     "description": "An email address was added to a user account.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "actor_id",
-      "actor",
       "email",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding an email address to your GitHub account"
   },
@@ -14766,18 +22257,30 @@
     "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "created_at",
-      "user",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14785,15 +22288,28 @@
     "description": "Audit log entries were exported.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "action",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ]
@@ -14803,20 +22319,31 @@
     "description": "A user was blocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_id",
-      "_document_id",
       "actor_id",
-      "@timestamp",
-      "user_agent",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -14824,18 +22351,30 @@
     "description": "A user changed their password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "actor_id",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14843,18 +22382,30 @@
     "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -14863,17 +22414,30 @@
     "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -14882,16 +22446,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
-      "user",
       "action",
-      "operation_type",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14899,16 +22477,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "_document_id",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14916,16 +22508,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user_id",
       "@timestamp",
-      "user",
+      "_document_id",
       "action",
-      "request_access_security_header"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14933,19 +22539,31 @@
     "description": "A new user account was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "email",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "created_at",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "programmatic_access_type"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "email",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14953,21 +22571,33 @@
     "description": "A user secret for Codespaces was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -14975,20 +22605,31 @@
     "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "oauth_application_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "@timestamp",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -14996,18 +22637,30 @@
     "description": "A user account was destroyed by an asynchronous job.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15016,19 +22669,30 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "oauth_application_id",
+      "_document_id",
       "action",
-      "user",
-      "created_at",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15036,18 +22700,30 @@
     "description": "A user deleted his or her account, triggering user.async_delete.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
-      "created_at",
-      "user_agent",
       "user_id",
-      "operation_type",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15055,18 +22731,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "user_agent",
       "user_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15074,18 +22762,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "_document_id",
-      "@timestamp",
-      "user",
-      "actor_id",
-      "action",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -15094,17 +22794,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "request_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15112,17 +22824,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15130,17 +22855,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15148,17 +22886,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15166,21 +22917,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15188,21 +22949,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -15211,17 +22982,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15229,17 +23013,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15247,17 +23044,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15265,18 +23075,30 @@
     "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "org_id",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15284,16 +23106,29 @@
     "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ]
   },
@@ -15302,17 +23137,31 @@
     "description": "A user requested a password reset.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
     "fields": [
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "email",
-      "created_at",
-      "user_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
   },
@@ -15321,17 +23170,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "created_at",
-      "user_agent",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "request_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15339,18 +23201,30 @@
     "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -15359,19 +23233,31 @@
     "description": "A user signed in.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "actor_id",
       "@timestamp",
-      "user",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "actor",
-      "passkey_nickname",
-      "request_access_security_header"
+      "passkey_nickname"
     ]
   },
   {
@@ -15379,18 +23265,30 @@
     "description": "A user signed out.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15398,38 +23296,61 @@
     "description": "A comment made by a user was minimized.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
-      "actor_id",
       "@timestamp",
-      "created_at",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "user.new_device_used",
+    "description": "A user signed in from a new device.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "user.new_device_used",
-    "description": "A user signed in from a new device.",
-    "docs_reference_links": "N/A",
-    "fields": [
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
       "user_agent",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15437,14 +23358,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15452,21 +23389,31 @@
     "description": "An ordinary user account was promoted to a site administrator.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
+      "user_id",
       "user_agent",
+      "created_at",
       "oauth_application_id",
-      "request_id",
-      "operation_type",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15474,16 +23421,29 @@
     "description": "A user's account was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user",
-      "action",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "operation_type"
     ]
   },
@@ -15492,20 +23452,31 @@
     "description": "An email address was removed from a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "actor_id",
       "created_at",
-      "email",
-      "token_scopes",
-      "programmatic_access_type"
+      "email"
     ]
   },
   {
@@ -15513,20 +23484,32 @@
     "description": "A user secret for Codespaces was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "key",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15534,17 +23517,30 @@
     "description": "A user account was no longer flagged as a large scale contributor.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15552,20 +23548,31 @@
     "description": "A username was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "request_id",
-      "actor_id",
-      "old_login",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_login",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15573,17 +23580,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "user_agent",
-      "request_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -15592,18 +23611,30 @@
     "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "action",
       "created_at",
-      "actor",
-      "operation_type",
-      "actor_id",
-      "user_id",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam"
   },
@@ -15612,18 +23643,30 @@
     "description": "A user reset their account password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15631,16 +23674,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -15651,16 +23707,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -15669,18 +23737,30 @@
     "description": "A user signed in from an unrecognized device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor",
-      "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -15688,18 +23768,30 @@
     "description": "A user signed in from an unrecognized device and location.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "created_at",
-      "_document_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15707,18 +23799,30 @@
     "description": "A user signed in from an unrecognized location.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "action",
-      "operation_type",
-      "user_agent",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
       "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15726,22 +23830,33 @@
     "description": "Triggered when you clear the status on your profile.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "message",
-      "user",
-      "actor_id",
       "created_at",
-      "request_id",
       "limited_availability",
-      "action",
       "emoji",
-      "operation_type",
-      "user_agent",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15749,23 +23864,33 @@
     "description": "Triggered when you set or change the status on your profile.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
     "fields": [
-      "limited_availability",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "message",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "limited_availability",
+      "message",
+      "created_at",
       "emoji",
-      "org",
-      "actor",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
   },
@@ -15774,21 +23899,31 @@
     "description": "A user account was suspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "user_agent",
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "token_scopes",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15796,18 +23931,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor_id",
-      "@timestamp",
-      "operation_type",
-      "_document_id",
-      "user_agent",
-      "actor",
-      "action",
       "user_id",
-      "created_at",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15815,18 +23962,30 @@
     "description": "A 2FA challenge issued for a user account failed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "actor_id",
-      "actor",
-      "user_id",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15836,16 +23995,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
       "user_agent",
-      "request_id",
-      "action",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15853,18 +24024,30 @@
     "description": "A user used their 2FA recovery codes.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15872,18 +24055,30 @@
     "description": "A user downloaded 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15891,17 +24086,30 @@
     "description": "A user printed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15909,18 +24117,30 @@
     "description": "A user viewed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
       "created_at",
-      "user",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15928,17 +24148,30 @@
     "description": "A user was prompted for a two-factor authentication code.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
     "fields": [
-      "user",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "actor"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
   },
@@ -15947,19 +24180,31 @@
     "description": "A user was unblocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "user_agent",
-      "user_id",
-      "user",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -15968,15 +24213,28 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user_agent",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "request_id",
-      "actor",
-      "action",
       "created_at"
     ]
   },
@@ -15985,21 +24243,31 @@
     "description": "A user account was unsuspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "user_agent",
       "actor",
-      "oauth_application_id",
-      "operation_type",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "user_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16007,21 +24275,33 @@
     "description": "A user secret for Codespaces was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -16029,18 +24309,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16048,27 +24340,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -16077,23 +24375,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -16101,10 +24409,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -16115,20 +24441,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -16137,23 +24452,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16163,10 +24486,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -16178,19 +24519,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -16201,10 +24532,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -16213,21 +24562,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -16237,23 +24575,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -16262,22 +24612,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16285,21 +24646,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -16307,25 +24679,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16333,23 +24713,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -16363,24 +24756,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -16389,10 +24791,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -16402,21 +24822,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -16426,25 +24836,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.15/organization.json b/src/audit-logs/data/ghes-3.15/organization.json
index 6c8b68aaf806..d9be92aea738 100644
--- a/src/audit-logs/data/ghes-3.15/organization.json
+++ b/src/audit-logs/data/ghes-3.15/organization.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,29 +67,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -72,21 +103,32 @@
     "description": "Credit was accepted for a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Editing a repository security advisory"
   },
@@ -95,21 +137,32 @@
     "description": "Someone was added to the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -117,21 +170,32 @@
     "description": "Credit was declined for a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -140,21 +204,32 @@
     "description": "Someone was removed from the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -163,18 +238,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -182,17 +269,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -203,39 +301,62 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
+  },
   {
     "action": "billing.change_billing_type",
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -244,19 +365,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -265,18 +398,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -284,18 +430,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -303,20 +461,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -325,20 +494,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -349,17 +529,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -367,14 +559,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -384,28 +591,34 @@
     "description": "An attempt to create a codespace from a prebuild was made.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "owner",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "user_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
       "created_at",
       "operation_type",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -413,17 +626,30 @@
     "description": "Enterprise setting for Codespaces ownership was updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enablement",
       "organization_names",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -434,25 +660,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -463,22 +698,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -490,22 +736,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -514,15 +771,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -533,15 +805,28 @@
     "description": "Policies were applied to codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -551,20 +836,30 @@
     "description": "Policies were removed from codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -572,19 +867,30 @@
     "description": "Policies were updated for codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -592,17 +898,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -612,27 +931,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "owner",
-      "pull_request_id",
-      "machine_type",
-      "user_id",
-      "user",
-      "devcontainer_path",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
+      "machine_type",
+      "devcontainer_path",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -640,19 +968,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -660,18 +1001,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -680,20 +1033,30 @@
     "description": "A commit comment was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "created_at",
-      "@timestamp",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "programmatic_access_type"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -701,21 +1064,30 @@
     "description": "A commit comment was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_id",
-      "action",
-      "@timestamp",
-      "repo",
       "org_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -723,21 +1095,33 @@
     "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "reason",
       "plan",
-      "org_id",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -745,13 +1129,28 @@
     "description": "Copilot feature settings were changed at the organization level.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -761,23 +1160,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -785,16 +1191,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -803,40 +1223,59 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "copilot.cfb_seat_assignment_reused",
-    "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
-      "request_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "copilot.cfb_seat_assignment_reused",
+    "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -846,20 +1285,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -867,19 +1316,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -887,21 +1348,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -909,21 +1379,33 @@
     "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_value",
       "new_value",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -931,21 +1413,32 @@
     "description": "The excluded paths for GitHub Copilot were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "excluded_paths",
       "owner_type",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -953,21 +1446,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -975,21 +1478,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -997,21 +1510,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1019,17 +1542,30 @@
     "description": "The plan for GitHub Copilot was updated.",
     "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_plan",
       "plan",
-      "business_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1041,20 +1577,31 @@
     "description": "The plan for GitHub Copilot was scheduled to be downgraded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "current_plan",
       "scheduled_plan"
@@ -1065,21 +1612,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "name",
-      "runner_group_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1089,19 +1645,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1111,21 +1676,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1135,18 +1709,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1159,18 +1746,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1184,14 +1784,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -1204,8 +1819,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1214,27 +1828,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1243,19 +1865,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1264,16 +1898,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "definition_id"
@@ -1285,19 +1932,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1306,19 +1964,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1327,19 +1996,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1348,19 +2028,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1369,17 +2060,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1387,19 +2091,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1408,19 +2123,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1428,19 +2154,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1449,19 +2186,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1469,19 +2217,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1490,19 +2249,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1510,19 +2280,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1531,20 +2312,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1552,21 +2343,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "repo_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "org_id",
-      "_document_id",
       "actor_id",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1574,20 +2374,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "request_id",
-      "org",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1595,22 +2405,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "actor_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "title",
-      "_document_id",
-      "created_at",
-      "repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -1618,21 +2437,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "team",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "number",
-      "org",
-      "title",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id"
+      "team",
+      "created_at",
+      "number",
+      "title",
+      "operation_type"
     ]
   },
   {
@@ -1640,18 +2471,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user_id",
-      "actor",
       "number",
-      "user",
-      "created_at",
-      "request_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1659,18 +2503,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "_document_id",
-      "request_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "number",
       "team",
       "created_at"
@@ -1681,21 +2536,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "_document_id",
-      "title",
-      "user",
-      "user_agent",
-      "org",
-      "operation_type",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "team",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type",
+      "team",
       "number"
     ]
   },
@@ -1704,17 +2570,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -1725,16 +2605,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -1745,18 +2639,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
       "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -1767,17 +2675,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was created.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "org_id",
       "action",
-      "request_id",
-      "org",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -1786,17 +2707,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "actor_id",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -1805,22 +2739,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1829,22 +2772,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1852,28 +2805,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1882,27 +2841,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1911,25 +2878,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1938,26 +2913,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1966,21 +2948,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1989,22 +2983,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2013,25 +3017,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2040,22 +3053,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2064,21 +3089,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -2089,19 +3124,30 @@
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2110,20 +3156,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2132,19 +3188,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2153,23 +3220,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2177,18 +3253,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2199,20 +3285,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2222,25 +3318,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -2248,25 +3354,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -2274,26 +3389,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -2302,25 +3426,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -2328,26 +3461,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "events",
-      "repo",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -2355,21 +3497,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -2378,19 +3531,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -2398,21 +3564,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -2421,19 +3598,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -2444,20 +3635,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2467,24 +3670,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2495,23 +3709,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2522,21 +3748,33 @@
     "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
       "operation_type",
-      "@timestamp",
       "integration",
-      "action",
-      "user_agent",
       "reason",
-      "_document_id",
-      "org",
-      "org_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -2547,20 +3785,32 @@
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
       "@timestamp",
-      "actor_id",
-      "org",
       "_document_id",
-      "requester",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "requester",
       "created_at",
       "url",
-      "org_id",
-      "request_id",
       "operation_type",
-      "actor",
       "integration",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -2570,20 +3820,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2593,19 +3856,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -2614,20 +3891,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -2637,20 +3927,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -2659,20 +3962,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -2681,20 +3997,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2702,19 +4030,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2723,19 +4064,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2744,17 +4098,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2767,21 +4134,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -2795,17 +4175,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2817,19 +4210,30 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "user"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2837,19 +4241,30 @@
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2857,20 +4272,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "user_id",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
-      "_document_id",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "actor_id",
       "operation_type",
-      "org",
       "created_at"
     ]
   },
@@ -2879,19 +4303,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2899,24 +4334,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2924,24 +4367,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "ip_allow_list_entry",
-      "org",
-      "operation_type",
-      "created_at",
-      "active",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at",
+      "active"
     ]
   },
   {
@@ -2949,19 +4400,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "actor_id",
       "ip_allow_list_entry",
-      "active",
-      "org_id",
-      "@timestamp"
+      "active"
     ]
   },
   {
@@ -2969,22 +4433,31 @@
     "description": "A comment on an issue was deleted from the repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "org",
-      "repo",
-      "actor_id",
       "@timestamp",
-      "created_at",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "oauth_application_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -2992,24 +4465,30 @@
     "description": "A comment on an issue was pinned to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3020,19 +4499,29 @@
     "description": "A comment on an issue was unpinned from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3043,22 +4532,31 @@
     "description": "A comment on an issue (other than the initial one) changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "action",
-      "repo_id",
-      "org_id",
-      "created_at",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "request_id",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
-      "oauth_application_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -3066,21 +4564,31 @@
     "description": "An issue was deleted from the repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue",
     "fields": [
-      "user",
-      "actor_id",
-      "created_at",
-      "title",
       "@timestamp",
       "_document_id",
-      "request_id",
-      "actor",
-      "user_id",
       "action",
-      "operation_type",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type"
     ],
     "docs_reference_titles": "Deleting an issue"
   },
@@ -3089,23 +4597,33 @@
     "description": "An issue was pinned to a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
       "action",
       "actor",
-      "operation_type",
-      "owner_type",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "number",
-      "repo",
-      "event",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "owner_type",
+      "number",
+      "event"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3114,22 +4632,32 @@
     "description": "An issue was transferred to another repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "owner_type",
-      "actor_id",
       "number",
-      "repo",
       "operation_type",
-      "_document_id",
-      "repo_id",
-      "action",
-      "request_id",
-      "created_at",
-      "actor",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Transferring an issue to another repository"
   },
@@ -3138,24 +4666,33 @@
     "description": "An issue was unpinned from a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
-      "event",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
-      "action",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "operation_type",
-      "_document_id",
-      "number",
-      "owner_type",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "token_scopes",
-      "request_access_security_header"
+      "user_agent",
+      "event",
+      "created_at",
+      "operation_type",
+      "number",
+      "owner_type"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3164,19 +4701,30 @@
     "description": "The ability for enterprise members to delete issues was disabled  Members cannot delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
-      "operation_type",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "user_id",
-      "created_at",
-      "_document_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "org_id"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3185,18 +4733,29 @@
     "description": "The ability for enterprise members to delete issues was enabled  Members can delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -3206,19 +4765,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user",
-      "request_id",
-      "actor",
-      "business_id",
-      "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3227,18 +4797,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3246,21 +4828,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -3268,21 +4863,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3290,22 +4898,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -3313,19 +4934,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -3335,22 +4969,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -3358,22 +5005,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3381,20 +5041,30 @@
     "description": "The ability for members to publish GitHub Pages sites was disabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3403,20 +5073,30 @@
     "description": "The ability for members to publish GitHub Pages sites was enabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3425,21 +5105,30 @@
     "description": "The ability for members to publish private GitHub Pages was disabled  Members cannot publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3448,22 +5137,30 @@
     "description": "The ability for members to publish private GitHub Pages was enabled  Members can publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3472,21 +5169,30 @@
     "description": "The ability for members to publish public GitHub Pages was disabled  Members cannot publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3495,22 +5201,30 @@
     "description": "The ability for members to publish public GitHub Pages was enabled  Members can publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3519,19 +5233,30 @@
     "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "operation_type",
       "user_agent",
-      "actor",
-      "actor_id",
-      "business_id",
-      "@timestamp",
-      "created_at",
-      "action"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3540,18 +5265,29 @@
     "description": "The ability for enterprise members to delete repositories was disabled  Members cannot delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "request_id",
-      "org",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "actor",
       "operation_type",
-      "org_id",
-      "action",
-      "@timestamp",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -3561,21 +5297,30 @@
     "description": "The ability for enterprise members to delete repositories was enabled  Members can delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "action",
-      "org_id",
-      "user_id",
-      "business",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
-      "org",
-      "operation_type",
-      "user_agent"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3586,16 +5331,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -3604,21 +5360,30 @@
     "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "created_at",
-      "user_id",
       "business_id",
-      "user",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "org_id",
-      "@timestamp"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -3627,19 +5392,30 @@
     "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "user_id",
-      "business",
-      "business_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "actor_id"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -3648,19 +5424,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3668,21 +5456,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3692,16 +5489,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3711,18 +5521,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3732,14 +5555,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -3747,19 +5586,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -3767,18 +5617,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3786,23 +5648,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -3810,16 +5680,30 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "org_id",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3827,24 +5711,32 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
-      "repo_id",
       "operation_type",
-      "@timestamp",
-      "user_agent",
       "created_at",
-      "org",
-      "action",
-      "_document_id",
-      "repo",
-      "actor",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3852,15 +5744,28 @@
     "description": "A network configuration for a hosted compute service was created.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -3878,15 +5783,28 @@
     "description": "A network configuration for a hosted compute service was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -3899,15 +5817,28 @@
     "description": "A network configuration for a hosted compute service was updated.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -3924,20 +5855,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3946,20 +5889,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3968,20 +5923,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3990,20 +5957,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4012,19 +5991,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4033,20 +6025,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4055,20 +6059,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4077,19 +6093,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4098,17 +6127,28 @@
     "description": "An invitation sent to an organization to join an enterprise was accepted.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4119,20 +6159,30 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
   },
@@ -4141,21 +6191,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -4164,24 +6224,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4189,21 +6259,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org_id",
-      "org",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -4211,20 +6291,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4232,22 +6322,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4255,20 +6353,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4276,22 +6384,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4299,19 +6415,30 @@
     "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4320,19 +6447,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -4342,15 +6480,28 @@
     "description": "Third-party application access for outside collaborators was disabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4361,15 +6512,28 @@
     "description": "Third-party application access for outside collaborators was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4380,15 +6544,28 @@
     "description": "The organization was archived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4398,17 +6575,30 @@
     "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
   },
@@ -4417,21 +6607,32 @@
     "description": "An export of the organization's Git events was created.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "start",
       "end",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization"
   },
@@ -4440,16 +6641,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -4458,18 +6672,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
-      "actor",
-      "user_agent",
-      "org_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "blocked_user",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -4478,19 +6705,30 @@
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -4500,22 +6738,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "email",
-      "@timestamp",
-      "actor",
-      "action",
       "operation_type",
-      "user_agent",
-      "org",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -4523,19 +6772,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -4543,23 +6803,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4567,21 +6835,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4589,21 +6867,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -4612,21 +6899,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -4635,20 +6931,31 @@
     "description": "Access to use Codespaces on internal and private repositories was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "enablement",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "enablement",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization"
   },
@@ -4657,21 +6964,31 @@
     "description": "Ownership and payment for codespaces was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "owner_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
   },
@@ -4680,16 +6997,29 @@
     "description": "A team has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4699,16 +7029,29 @@
     "description": "A team has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4718,19 +7061,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -4739,17 +7093,30 @@
     "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -4758,21 +7125,30 @@
     "description": "A user has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -4780,21 +7156,30 @@
     "description": "A user has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -4802,16 +7187,29 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
@@ -4821,17 +7219,30 @@
     "description": "The interaction limit for prior contributors only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -4840,17 +7251,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -4860,16 +7284,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -4878,17 +7315,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -4897,17 +7347,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -4916,22 +7379,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -4940,17 +7411,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4961,15 +7443,28 @@
     "description": "Server statistics were exported for the organization.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4980,18 +7475,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
-      "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -5000,20 +7507,31 @@
     "description": "A GitHub Actions secret was created for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5022,20 +7540,32 @@
     "description": "A GitHub Actions variable was created for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5044,21 +7574,33 @@
     "description": "A Codespaces or Dependabot secret was created for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5066,21 +7608,30 @@
     "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "org_id",
-      "business",
-      "action",
       "@timestamp",
-      "org",
       "_document_id",
-      "business_id",
+      "action",
       "actor",
-      "token_scopes",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "actor_is_bot",
       "oauth_credential_type",
       "managed_oauth_access_id",
@@ -5096,24 +7647,32 @@
     "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
-      "created_at",
-      "org_id",
-      "business_id",
-      "operation_type",
-      "request_id",
       "_document_id",
       "action",
+      "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "token_scopes",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot",
       "oauth_credential_type",
-      "request_access_security_header",
       "managed_oauth_access_id",
       "managed_token_id",
       "managed_oauth_scopes",
@@ -5127,21 +7686,32 @@
     "description": "An owner revoked authorized credentials.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "oauth_application_id",
-      "org_id",
       "operation_type",
-      "action",
-      "business",
-      "request_id",
       "created_at",
-      "business_id",
-      "actor_id",
-      "_document_id",
-      "user_agent",
       "oauth_credential_type",
       "managed_oauth_access_id",
       "managed_token_id",
@@ -5156,18 +7726,30 @@
     "description": "An organization was deleted by a user or staff.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "org_id",
-      "org",
       "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5175,20 +7757,30 @@
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -5197,16 +7789,29 @@
     "description": "Third-party application access restrictions for an organization were disabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization"
@@ -5216,19 +7821,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -5237,14 +7853,31 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sso_url",
       "issuer",
-      "action",
-      "@timestamp",
-      "_document_id",
       "created_at",
-      "org",
       "operation_type"
     ]
   },
@@ -5253,21 +7886,30 @@
     "description": "Display of IP addresses within audit log events for the organization was disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -5276,17 +7918,30 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5294,19 +7949,30 @@
     "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5314,19 +7980,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
-      "action",
-      "actor_id",
-      "org_id"
+      "created_at"
     ]
   },
   {
@@ -5334,19 +8011,30 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -5355,17 +8043,30 @@
     "description": "Third-party application access restrictions for an organization were enabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "operation_type",
-      "org",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization"
   },
@@ -5374,19 +8075,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -5395,19 +8107,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "sso_url",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "issuer",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "sso_url",
+      "created_at",
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -5416,21 +8141,30 @@
     "description": "Display of IP addresses within audit log events for the organization was enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -5439,17 +8173,30 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org_id",
       "operation_type",
-      "created_at",
-      "request_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
   },
@@ -5458,17 +8205,30 @@
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -5477,18 +8237,31 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
-      "org",
-      "user_agent",
-      "request_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "manager",
       "operation_type",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5496,23 +8269,32 @@
     "description": "A new user was invited to join an organization.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
     "fields": [
-      "org",
-      "user_id",
-      "invitation_id",
-      "org_id",
-      "user",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -5521,17 +8303,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5541,19 +8334,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5561,19 +8365,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5581,19 +8396,31 @@
     "description": "Access to an organization was granted for an OAuth App.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "operation_type",
-      "org_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization"
@@ -5603,20 +8430,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -5625,18 +8463,31 @@
     "description": "Access was disabled for an OAuth App that was previously approved.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization",
     "fields": [
-      "request_id",
-      "url",
-      "created_at",
-      "org_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
@@ -5646,19 +8497,31 @@
     "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "url",
-      "org_id",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "url",
       "oauth_application_name"
     ]
   },
@@ -5667,20 +8530,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -5690,16 +8564,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5707,20 +8594,31 @@
     "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "reason",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "reason",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -5729,20 +8627,30 @@
     "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -5751,19 +8659,30 @@
     "description": "An organization owner downloaded the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -5772,19 +8691,30 @@
     "description": "An organization owner generated the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -5793,19 +8723,30 @@
     "description": "An organization owner printed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -5814,19 +8755,30 @@
     "description": "An organization owner viewed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -5835,19 +8787,31 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -5856,20 +8820,31 @@
     "description": "A GitHub Actions secret was removed from an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5878,21 +8853,31 @@
     "description": "A GitHub Actions variable was removed from an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5901,18 +8886,29 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
@@ -5922,22 +8918,32 @@
     "description": "A Codespaces or Dependabot secret was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5945,21 +8951,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5967,21 +8982,30 @@
     "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user",
-      "org_id",
-      "created_at",
-      "request_id",
       "@timestamp",
-      "action",
-      "operation_type",
-      "user_agent",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5989,21 +9013,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -6011,18 +9045,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -6031,19 +9077,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_login",
-      "org_id",
-      "request_id",
-      "actor_id",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6051,14 +9109,28 @@
     "description": "Triggered when a required workflow is created.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6069,14 +9141,28 @@
     "description": "Triggered when a required workflow is deleted.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6087,14 +9173,28 @@
     "description": "Triggered when a required workflow is updated.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6105,20 +9205,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -6127,18 +9237,29 @@
     "description": "A member's linked identity was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
       "user_id",
-      "@timestamp",
-      "action",
-      "actor_id",
       "user_agent",
-      "_document_id",
-      "request_id",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
@@ -6148,19 +9269,30 @@
     "description": "A member's SAML session was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
-      "actor_id",
-      "created_at",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
   },
@@ -6169,21 +9301,33 @@
     "description": "A self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -6193,21 +9337,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6216,20 +9370,31 @@
     "description": "A self-hosted runner group was renamed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6238,23 +9403,33 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -6263,23 +9438,31 @@
     "description": "A self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6288,19 +9471,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -6309,25 +9505,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6336,21 +9543,32 @@
     "description": "The visibility of a self-hosted runner group was updated via the REST API.",
     "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
   },
@@ -6359,21 +9577,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -6383,21 +9610,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -6407,20 +9643,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6429,22 +9675,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6453,21 +9707,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6476,21 +9739,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6499,22 +9771,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6523,21 +9803,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6546,22 +9835,30 @@
     "description": "Generic secrets have been disabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6569,22 +9866,30 @@
     "description": "Generic secrets have been enabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6592,21 +9897,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -6616,21 +9930,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -6640,19 +9963,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -6662,21 +9996,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -6686,21 +10029,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -6710,19 +10062,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -6732,22 +10095,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6756,22 +10127,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6780,22 +10159,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6804,21 +10191,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6827,21 +10223,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6850,22 +10255,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6874,22 +10287,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6898,26 +10319,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6925,28 +10354,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6954,26 +10391,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6981,15 +10426,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -6998,15 +10460,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7015,7 +10494,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -7030,20 +10530,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -7052,16 +10563,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -7072,18 +10596,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -7092,17 +10629,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7110,18 +10660,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -7130,18 +10692,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -7150,18 +10725,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -7170,22 +10757,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issuer",
-      "business",
       "operation_type",
       "created_at",
-      "request_id",
-      "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7193,21 +10790,32 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
   },
@@ -7216,19 +10824,30 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -7239,15 +10858,28 @@
     "description": "The organization was unarchived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7257,19 +10889,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
-      "oauth_application_id",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "blocked_user",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -7278,20 +10923,32 @@
     "description": "A GitHub Actions secret was updated for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "created_at",
       "key",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -7300,23 +10957,34 @@
     "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -7325,20 +10993,32 @@
     "description": "A GitHub Actions variable was updated for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -7347,20 +11027,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -7368,22 +11060,33 @@
     "description": "A Codespaces or Dependabot secret was updated for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7392,20 +11095,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -7413,17 +11127,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -7433,20 +11160,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -7455,17 +11193,30 @@
     "description": "The name of the default branch was changed for new repositories in the organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
   },
@@ -7474,17 +11225,30 @@
     "description": "The repository self-hosted runners policy was updated",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_repo_runners_policy",
       "new_repo_runners_policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -7495,19 +11259,32 @@
     "description": "An organization's SAML provider settings were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "issuer",
-      "org",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -7515,18 +11292,30 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "org",
-      "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
@@ -7535,18 +11324,30 @@
     "description": "A default label was created for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
-      "_document_id",
-      "action",
-      "created_at",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label"
   },
@@ -7555,17 +11356,30 @@
     "description": "A default label was deleted for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label"
   },
@@ -7574,17 +11388,30 @@
     "description": "A default label was edited for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label",
     "fields": [
-      "org",
-      "created_at",
       "@timestamp",
-      "actor",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label"
   },
@@ -7593,20 +11420,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "org_id",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -7615,16 +11455,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -7633,14 +11488,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -7651,16 +11521,31 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "operation_type",
-      "domain_name",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
       "_document_id",
-      "actor_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "domain_name",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -7669,16 +11554,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -7688,17 +11586,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7708,16 +11617,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -7727,20 +11649,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -7748,19 +11680,30 @@
     "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor",
-      "business_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
       "user_agent",
-      "_document_id",
       "created_at",
-      "operation_type",
-      "request_id",
-      "business"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -7769,19 +11712,30 @@
     "description": "Organization projects were disabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -7790,18 +11744,29 @@
     "description": "Organization projects were enabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor_id",
-      "org_id",
-      "created_at",
-      "user_id",
-      "org",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
@@ -7811,23 +11776,33 @@
     "description": "An organization role was assigned to a user or team.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About custom organization roles"
   },
@@ -7836,25 +11811,32 @@
     "description": "A custom organization role was created in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -7866,25 +11848,32 @@
     "description": "A custom organization role was deleted in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -7895,19 +11884,30 @@
     "description": "A user or team was unassigned an organization role.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type"
     ],
@@ -7918,26 +11918,33 @@
     "description": "A custom organization role was edited in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
       "old_role_permissions",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -7950,20 +11957,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -7973,23 +11991,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -7998,21 +12027,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -8023,21 +12063,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8046,20 +12099,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8068,17 +12135,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8089,20 +12171,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8111,18 +12207,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8130,16 +12238,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8147,18 +12269,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8166,18 +12300,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8188,18 +12335,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8210,17 +12370,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8231,18 +12404,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8254,17 +12440,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8276,20 +12475,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -8301,20 +12509,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -8326,20 +12543,29 @@
     "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -8351,20 +12577,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -8376,15 +12611,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8394,17 +12644,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8414,15 +12675,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8432,19 +12708,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "business_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8452,23 +12739,30 @@
     "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "created_at",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
-      "repo",
       "action",
-      "user_agent",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "request_id",
-      "user_id",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8476,23 +12770,30 @@
     "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "repo",
-      "org",
-      "business",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org_id",
-      "created_at",
-      "business_id"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8500,17 +12801,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8520,17 +12832,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8540,17 +12863,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8560,17 +12894,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8580,17 +12925,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -8600,17 +12958,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8618,20 +12989,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -8641,25 +13023,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -8667,20 +13061,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8688,25 +13094,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8714,17 +13132,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8732,17 +13163,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8750,18 +13194,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -8770,18 +13226,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -8790,19 +13258,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -8810,17 +13289,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -8832,22 +13324,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -8855,19 +13356,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8875,17 +13387,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8893,18 +13418,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -8912,20 +13450,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8933,18 +13481,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -8953,18 +13513,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -8973,16 +13545,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -8994,21 +13579,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "project_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -9016,22 +13613,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -9040,29 +13647,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9070,24 +13682,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "repo_id",
-      "user_id",
       "@timestamp",
-      "user_agent",
-      "repo",
-      "name",
-      "org_id",
-      "user",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -9098,21 +13718,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -9123,22 +13753,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -9146,24 +13786,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "authorized_actors_only",
       "authorized_actors",
       "created_at",
-      "user_agent",
       "name",
-      "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
-      "actor_id",
-      "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -9171,30 +13821,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -9204,28 +13861,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "business",
-      "org_id",
       "operation_type",
-      "request_id",
-      "repo_id",
-      "actor",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -9236,23 +13901,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -9260,22 +13934,32 @@
     "description": "Branch deletion was enabled or disabled for a protected branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "operation_type",
-      "request_id",
-      "repo",
       "@timestamp",
-      "org_id",
-      "org",
-      "action",
-      "allow_deletions_enforcement_level",
       "_document_id",
-      "created_at",
-      "actor_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_deletions_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -9283,23 +13967,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "actor_id",
-      "name",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo",
-      "operation_type",
-      "request_id",
-      "allow_force_pushes_enforcement_level",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_force_pushes_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -9307,24 +14000,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -9333,22 +14035,32 @@
     "description": "Required linear commit history was enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "operation_type",
       "actor",
-      "linear_history_requirement_enforcement_level",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "linear_history_requirement_enforcement_level",
       "name",
-      "org_id",
-      "repo_id",
-      "org",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -9356,24 +14068,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "lock_allows_fetch_and_merge",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -9382,27 +14103,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -9411,18 +14139,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9433,24 +14174,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -9458,25 +14208,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9484,22 +14241,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -9507,22 +14274,33 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
   },
@@ -9531,22 +14309,32 @@
     "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "required_approving_review_count",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -9554,25 +14342,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
     ]
   },
   {
@@ -9580,22 +14375,32 @@
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
       "action",
       "actor",
       "actor_id",
-      "signature_requirement_enforcement_level",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "programmatic_access_type"
+      "operation_type",
+      "name",
+      "created_at",
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -9603,46 +14408,67 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "operation_type",
+      "strict_required_status_checks_policy"
+    ]
+  },
+  {
+    "action": "public_key.create",
+    "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
+    "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "name",
-      "actor",
-      "repo",
-      "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "public_key.create",
-    "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
-    "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
-    "fields": [
       "read_only",
-      "user_agent",
-      "actor_id",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -9651,24 +14477,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -9677,20 +14514,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -9699,21 +14550,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -9723,22 +14587,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -9747,25 +14623,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -9774,23 +14660,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -9799,18 +14696,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -9820,21 +14731,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "pull_request_id",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -9843,19 +14765,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -9866,23 +14801,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -9892,17 +14839,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -9910,19 +14871,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -9930,19 +14904,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -9952,21 +14939,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -9975,27 +14973,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "pull_request_url",
       "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10003,23 +15008,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -10028,18 +15045,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -10047,19 +15078,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -10069,20 +15112,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
-      "repo",
-      "created_at",
-      "request_id",
-      "comment_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "comment_id",
+      "operation_type"
     ]
   },
   {
@@ -10090,18 +15144,31 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "_document_id",
-      "@timestamp",
-      "comment_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "comment_id"
     ]
   },
   {
@@ -10109,21 +15176,33 @@
     "description": "A review on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -10131,20 +15210,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -10153,19 +15245,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -10175,22 +15281,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -10199,21 +15315,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -10222,25 +15347,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -10249,23 +15381,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -10274,24 +15414,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -10300,23 +15447,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -10326,22 +15481,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -10350,19 +15514,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -10371,24 +15548,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -10397,24 +15584,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -10422,24 +15617,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -10447,23 +15650,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "tool",
-      "branch",
-      "category",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "tool",
+      "branch",
+      "category",
+      "public_repo",
       "created_at",
       "operation_type"
     ],
@@ -10474,25 +15686,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -10501,26 +15719,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -10529,25 +15755,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "query_suite",
       "threat_model",
       "languages",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -10557,19 +15792,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to this repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -10578,19 +15824,30 @@
     "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -10598,17 +15855,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -10617,15 +15887,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -10636,16 +15919,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -10655,39 +15951,63 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
   {
-    "action": "repo.config.enable_contributors_only",
-    "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
-    "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+    "action": "repo.config.enable_contributors_only",
+    "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
+    "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -10696,17 +16016,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -10715,26 +16048,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -10743,30 +16082,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -10776,20 +16120,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -10798,25 +16153,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -10825,23 +16188,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -10849,25 +16223,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -10877,23 +16260,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -10903,23 +16295,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -10927,21 +16329,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -10949,21 +16361,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -10971,22 +16393,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -10994,21 +16425,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -11016,20 +16457,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11037,22 +16489,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11060,18 +16521,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11079,22 +16554,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11102,21 +16587,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11124,18 +16619,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -11144,22 +16651,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -11168,24 +16684,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -11194,23 +16718,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11218,26 +16752,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -11246,21 +16785,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -11269,25 +16817,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "repo_id",
-      "user_agent",
-      "topic",
-      "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
-      "programmatic_access_type"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "topic",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11295,22 +16849,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -11319,25 +16883,34 @@
     "description": "A branch was renamed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "old_branch",
-      "new_branch",
-      "default_branch",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "old_branch",
+      "new_branch",
+      "default_branch",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch"
@@ -11347,19 +16920,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11367,17 +16951,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -11386,17 +16985,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -11405,7 +17019,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -11420,23 +17055,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -11446,20 +17090,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11470,21 +17125,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -11493,22 +17159,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -11517,21 +17193,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -11540,22 +17227,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -11566,16 +17263,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -11585,22 +17293,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -11609,23 +17328,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11635,19 +17364,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -11655,21 +17394,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -11678,50 +17427,66 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "old_policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id"
-    ]
-  },
-  {
-    "action": "repo.update_actions_secret",
-    "description": "A GitHub Actions secret was updated for a repository.",
-    "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
+      "old_policy",
       "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "repo.update_actions_secret",
+    "description": "A GitHub Actions secret was updated for a repository.",
+    "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -11730,24 +17495,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11756,25 +17531,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -11783,22 +17566,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11807,26 +17599,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11834,31 +17634,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11867,22 +17674,30 @@
     "description": "Someone closed a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories",
     "fields": [
-      "actor",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "created_at",
-      "repo_id",
-      "_document_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "About repository security advisories"
   },
@@ -11891,18 +17706,29 @@
     "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "_document_id",
+      "operation_type",
       "created_at"
     ]
   },
@@ -11911,17 +17737,30 @@
     "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -11930,21 +17769,30 @@
     "description": "GitHub withdrew a security advisory that was published in error.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -11952,18 +17800,30 @@
     "description": "Someone opened a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
       "repo_id",
-      "action",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11971,21 +17831,30 @@
     "description": "Someone published a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "repo_id",
       "_document_id",
-      "repo",
-      "business_id",
-      "business",
-      "request_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "org"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11993,17 +17862,30 @@
     "description": "Someone reopened as draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "repo",
-      "action",
-      "created_at",
       "@timestamp",
-      "request_id",
-      "actor_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "public_repo"
     ]
   },
@@ -12012,21 +17894,30 @@
     "description": "Someone edited a draft or published security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "repo_id",
-      "org_id",
       "business",
-      "actor",
-      "user_agent",
-      "created_at",
-      "_document_id",
       "business_id",
-      "repo",
-      "action",
-      "operation_type",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12034,24 +17925,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -12060,24 +17957,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -12086,19 +17989,30 @@
     "description": "Data use settings were disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "repo_id",
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -12107,21 +18021,30 @@
     "description": "Data use settings were enabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "org",
-      "user_id",
-      "repo_id",
       "@timestamp",
-      "request_id",
-      "actor",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org_id",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -12130,23 +18053,30 @@
     "description": "The dependency graph was disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "repo_id",
-      "operation_type",
-      "user_id",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
-      "@timestamp",
-      "org_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -12155,24 +18085,31 @@
     "description": "The dependency graph was enabled for a private repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor_id",
-      "repo_id",
+      "created_at",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12181,21 +18118,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -12203,21 +18150,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12225,21 +18182,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -12247,20 +18215,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -12268,21 +18248,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12290,19 +18281,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -12310,19 +18314,30 @@
     "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise  Organization owners can now control their repository projects settings.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "user_agent",
-      "user",
-      "business_id",
-      "business",
-      "operation_type",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -12331,20 +18346,30 @@
     "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
       "@timestamp",
-      "repo",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "repo_id",
-      "actor",
-      "request_id",
-      "programmatic_access_type"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12353,20 +18378,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
       "created_at",
-      "org_id",
-      "action",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "actor_id",
-      "repo"
+      "operation_type"
     ]
   },
   {
@@ -12374,31 +18408,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -12407,19 +18449,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -12427,8 +18480,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -12437,23 +18489,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -12478,26 +18539,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -12506,26 +18573,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -12534,23 +18607,30 @@
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12560,23 +18640,30 @@
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12586,24 +18673,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12613,24 +18707,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -12639,24 +18740,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12666,23 +18774,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12692,23 +18807,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -12717,22 +18840,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12740,24 +18871,32 @@
     "description": "Generic secrets have been disabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -12765,22 +18904,31 @@
     "description": "Generic secrets have been enabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -12789,24 +18937,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -12815,24 +18971,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -12841,19 +19005,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12862,24 +19038,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12888,24 +19072,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12914,19 +19106,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12935,26 +19139,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12963,26 +19172,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -12991,28 +19205,36 @@
     "description": "A code security configuration was applied to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13020,27 +19242,35 @@
     "description": "A code security configuration failed to attach to the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
-      "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
+      "repository_security_configuration_failure_reason",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13048,28 +19278,36 @@
     "description": "A code security configuration was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13077,28 +19315,36 @@
     "description": "A code security configuration was removed due to a change in repository or enterprise settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13106,20 +19352,30 @@
     "description": "The repository visibility change setting was cleared for an organization or enterprise.",
     "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
       "business",
-      "action",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business_id",
-      "@timestamp",
       "user_agent",
-      "actor",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise"
   },
@@ -13128,20 +19384,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "org_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
-      "user_id",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13149,19 +19415,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "_document_id",
       "@timestamp",
-      "user_agent",
-      "user",
-      "created_at",
-      "org",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13169,29 +19446,37 @@
     "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -13200,29 +19485,37 @@
     "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -13231,19 +19524,32 @@
     "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
-      "operation_type",
-      "request_id",
-      "repo_id",
       "@timestamp",
-      "user_agent",
-      "alert_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "alert_id",
+      "created_at",
+      "alert_number"
     ],
     "docs_reference_titles": "About Dependabot alerts"
   },
@@ -13252,23 +19558,32 @@
     "description": "A Dependabot alert was manually dismissed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "org_id",
-      "user_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "alert_id",
-      "actor",
-      "repo",
       "created_at",
-      "org",
-      "_document_id",
-      "action",
-      "actor_id",
       "dismiss_reason",
-      "user",
       "dismiss_comment",
       "alert_number",
       "actor_is_bot"
@@ -13279,21 +19594,33 @@
     "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "public_repo",
       "owner",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "token_scopes",
       "alert_number"
     ]
   },
@@ -13302,26 +19629,34 @@
     "description": "A Dependabot alert was manually reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo",
-      "alert_number",
-      "request_access_security_header"
+      "alert_number"
     ]
   },
   {
@@ -13329,21 +19664,32 @@
     "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "alert_id",
-      "repo",
-      "operation_type",
-      "action",
-      "repo_id",
-      "_document_id",
-      "user_agent",
-      "request_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "operation_type",
+      "created_at",
+      "alert_number"
     ]
   },
   {
@@ -13351,20 +19697,30 @@
     "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
     "fields": [
-      "org",
+      "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
-      "operation_type",
-      "created_at",
-      "actor",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
   },
@@ -13373,24 +19729,31 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13398,26 +19761,32 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13425,23 +19794,30 @@
     "description": "Dependabot alerts was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "request_id",
-      "repo_id",
-      "action",
-      "actor_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "_document_id",
       "user_id",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13449,23 +19825,30 @@
     "description": "Dependabot alerts was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_agent",
-      "created_at",
       "@timestamp",
-      "repo_id",
+      "_document_id",
       "action",
-      "user",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor_id",
-      "_document_id",
-      "user_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -13474,24 +19857,31 @@
     "description": "A status check was marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "org",
-      "actor_id",
       "@timestamp",
-      "business",
-      "request_id",
-      "context",
-      "repo_id",
-      "action",
-      "repo",
       "_document_id",
-      "operation_type",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "created_at",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "context",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -13500,21 +19890,31 @@
     "description": "A status check was no longer marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "actor_id",
-      "actor",
-      "created_at",
-      "context",
-      "operation_type",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "repo_id",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
       "repo",
-      "programmatic_access_type"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "context",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -13523,18 +19923,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -13543,19 +19956,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -13564,22 +19989,33 @@
     "description": "A new custom repository role was created.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "role_permissions",
       "old_role_permissions"
     ],
@@ -13590,23 +20026,34 @@
     "description": "A custom repository role was deleted.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing custom repository roles for an organization"
   },
@@ -13615,23 +20062,34 @@
     "description": "A custom repository role was edited.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "old_role_permissions",
       "old_base_role"
     ],
@@ -13642,14 +20100,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -13663,22 +20135,32 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
@@ -13687,14 +20169,28 @@
     "description": "A leaked secret was reported to the secret's provider by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "created_at",
@@ -13709,28 +20205,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -13738,25 +20243,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13764,14 +20276,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -13788,19 +20314,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13809,19 +20346,30 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13830,20 +20378,30 @@
     "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13852,19 +20410,30 @@
     "description": "Secret scanning was enabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13873,14 +20442,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -13898,25 +20481,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13925,25 +20516,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -13953,25 +20552,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -13980,10 +20587,28 @@
     "description": "A security configuration was created",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -13998,15 +20623,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14024,22 +20642,33 @@
     "description": "A default security configuration setting for new repositories was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14048,22 +20677,33 @@
     "description": "A default security configuration setting for new repositories was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14072,10 +20712,28 @@
     "description": "A security configuration was deleted",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -14090,15 +20748,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14115,15 +20766,30 @@
     "description": "A security configuration policy was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enforcement",
       "security_configuration_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14133,10 +20799,28 @@
     "description": "A security configuration was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -14151,15 +20835,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14177,16 +20854,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14196,18 +20886,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -14216,16 +20919,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14235,15 +20951,28 @@
     "description": "An agreement for invoiced billing for GitHub Sponsors was signed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -14255,15 +20984,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -14273,15 +21015,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -14290,17 +21047,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -14309,17 +21079,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -14328,16 +21112,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -14347,14 +21144,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -14364,17 +21176,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -14382,18 +21207,31 @@
     "action": "sponsors.sponsored_developer_create",
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
-    "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
+    "fields": [
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -14402,18 +21240,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14422,15 +21273,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -14440,16 +21305,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14457,15 +21335,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -14476,16 +21367,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -14495,17 +21399,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -14516,17 +21433,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -14537,18 +21467,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14558,16 +21499,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14577,16 +21531,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14598,17 +21565,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -14617,19 +21597,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -14638,21 +21631,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "user",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
       "action",
-      "user_id",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "actor_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -14661,19 +21663,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -14682,15 +21695,28 @@
     "description": "Dependabot encrypted config was read.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "public_repo"
@@ -14701,20 +21727,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14722,18 +21762,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -14741,16 +21796,31 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "domain_name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14758,23 +21828,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14782,23 +21862,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14806,23 +21896,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14830,23 +21930,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14854,21 +21964,31 @@
     "description": "A member of an organization was added to a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
-      "user",
       "@timestamp",
-      "actor_id",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "org",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -14878,22 +21998,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -14902,20 +22031,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -14924,18 +22064,31 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
       "created_at",
       "operation_type",
-      "actor_id",
-      "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
@@ -14945,21 +22098,32 @@
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -14968,21 +22132,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -14991,19 +22165,31 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "team",
       "org_id",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
       "operation_type",
-      "_document_id",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -15012,19 +22198,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
       "business",
-      "action",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15032,19 +22229,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "request_id",
       "actor",
-      "org",
-      "created_at",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15052,18 +22260,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
       "@timestamp",
-      "action",
       "_document_id",
-      "user_agent",
-      "user_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -15072,19 +22291,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "actor",
-      "action",
-      "operation_type",
-      "team",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -15092,19 +22323,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "actor_id",
       "_document_id",
-      "team",
-      "created_at",
-      "org_id",
       "action",
-      "request_id",
-      "user_agent",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_access_security_header"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "team",
+      "created_at"
     ]
   },
   {
@@ -15112,22 +22355,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "team",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15135,22 +22387,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -15159,22 +22420,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -15182,23 +22452,33 @@
   {
     "action": "team.remove_repository",
     "description": "A repository was removed from a team's control.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "org",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -15206,21 +22486,32 @@
     "description": "A team's name was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "user_agent",
-      "created_at",
-      "team",
-      "operation_type",
-      "actor_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -15229,17 +22520,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -15248,19 +22552,30 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -15269,19 +22584,30 @@
     "description": "The Okta credentials for team synchronization with a tenant were changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -15289,28 +22615,37 @@
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
       "operation_type",
       "created_at",
-      "user_agent",
       "permission",
       "new_repo_permission",
       "new_repo_base_role",
       "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_repo_base_role"
     ]
   },
   {
@@ -15318,16 +22653,30 @@
     "description": "A Dependabot rule was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15337,16 +22686,30 @@
     "description": "A Dependabot rule was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15356,18 +22719,31 @@
     "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15377,21 +22753,33 @@
     "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15399,21 +22787,32 @@
     "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -15421,21 +22820,32 @@
     "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -15443,16 +22853,30 @@
     "description": "A Dependabot rule's conditions, actions, or metadata changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15462,27 +22886,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -15491,23 +22921,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15515,10 +22955,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -15529,20 +22987,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -15551,23 +22998,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15577,10 +23032,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -15592,19 +23065,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -15615,10 +23078,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -15627,21 +23108,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -15651,23 +23121,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -15676,22 +23158,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15699,21 +23192,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -15721,25 +23225,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15747,23 +23259,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -15777,24 +23302,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -15803,10 +23337,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -15816,21 +23368,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -15840,25 +23382,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.15/user.json b/src/audit-logs/data/ghes-3.15/user.json
index f302c013870a..8f6a88ea4bc6 100644
--- a/src/audit-logs/data/ghes-3.15/user.json
+++ b/src/audit-logs/data/ghes-3.15/user.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,17 +67,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
-      "user_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -61,18 +98,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
+      "token_scopes",
       "user",
-      "request_id",
-      "_document_id",
-      "user_agent",
-      "actor",
       "user_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -80,18 +129,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "token_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -99,29 +160,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -129,18 +196,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -148,17 +227,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -167,19 +259,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -188,18 +292,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -207,18 +324,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -226,15 +355,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -244,17 +386,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -265,20 +420,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -287,19 +454,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -308,19 +488,31 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -329,20 +521,32 @@
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -351,19 +555,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -372,20 +588,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -394,20 +621,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -418,17 +656,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -436,14 +686,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -453,25 +718,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -482,22 +756,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -509,22 +794,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -533,15 +829,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -552,17 +863,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -572,27 +896,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "org",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -600,38 +933,63 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "owner",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "codespaces.trusted_repositories_access_update",
-    "description": "A personal account's access and security setting for Codespaces were updated.",
-    "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
+      "operation_type",
       "created_at",
-      "_document_id"
+      "public_repo"
+    ]
+  },
+  {
+    "action": "codespaces.trusted_repositories_access_update",
+    "description": "A personal account's access and security setting for Codespaces were updated.",
+    "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -640,23 +998,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -664,16 +1029,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -682,24 +1061,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -707,15 +1092,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -725,20 +1123,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -746,19 +1154,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -766,65 +1186,92 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id"
-    ]
-  },
-  {
-    "action": "custom_hosted_runner.create",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "name",
-      "runner_group_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
   },
   {
-    "action": "custom_hosted_runner.destroy",
+    "action": "custom_hosted_runner.create",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "custom_hosted_runner.destroy",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -834,21 +1281,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -858,19 +1314,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -879,19 +1346,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -900,19 +1378,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -921,19 +1410,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -942,17 +1442,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -960,19 +1473,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -981,39 +1505,61 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
-    ]
-  },
-  {
-    "action": "dependabot_security_updates_new_repos.disable",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "dependabot_security_updates_new_repos.disable",
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1022,19 +1568,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1042,19 +1599,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1063,19 +1631,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1083,19 +1662,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1104,20 +1694,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1125,22 +1725,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1149,22 +1758,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1172,28 +1791,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "business",
       "business_id",
-      "public_repo",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "visibility",
+      "operation_type",
+      "created_at",
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1202,27 +1827,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1231,25 +1864,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1258,26 +1899,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1286,21 +1934,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1309,22 +1969,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1333,25 +2003,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1360,22 +2039,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1384,23 +2075,33 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "new_value",
-      "approvers_was",
-      "approvers",
       "programmatic_access_type",
-      "can_admins_bypass",
-      "prevent_self_review"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_value",
+      "approvers_was",
+      "approvers",
+      "can_admins_bypass",
+      "prevent_self_review"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1409,21 +2110,32 @@
     "description": "A gist was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "gist_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "visibility",
-      "action",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ]
   },
   {
@@ -1431,20 +2143,32 @@
     "description": "A gist was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "gist_id",
-      "visibility",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "user",
-      "request_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "programmatic_access_type"
+      "gist_id",
+      "visibility",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1452,21 +2176,32 @@
     "description": "The visibility of a gist was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "user",
-      "gist_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "visibility",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "gist_id",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -1474,22 +2209,33 @@
     "description": "An SSH key was added to a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1498,23 +2244,34 @@
     "description": "An SSH key was removed from a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
       "explanation",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1523,23 +2280,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1547,18 +2313,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1569,20 +2345,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1592,37 +2378,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "user",
-      "operation_type",
       "_document_id",
-      "actor",
       "action",
-      "user_agent",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "gpg_key.destroy",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "gpg_key.destroy",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1630,25 +2440,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -1656,25 +2476,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -1682,26 +2511,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -1710,25 +2548,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -1736,26 +2583,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -1763,21 +2619,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -1786,41 +2653,65 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "actor_id",
-      "request_id",
       "@timestamp",
-      "name",
-      "integration",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "created_at",
-      "user_agent"
-    ]
-  },
-  {
-    "action": "integration.generate_client_secret",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "integration.generate_client_secret",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -1829,19 +2720,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -1852,20 +2757,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -1875,24 +2792,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -1903,23 +2831,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -1930,20 +2870,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -1953,19 +2906,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -1974,20 +2941,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -1997,20 +2977,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -2019,20 +3012,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -2041,20 +3047,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2062,19 +3080,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2083,19 +3114,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2104,17 +3148,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2127,21 +3184,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -2155,17 +3225,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2177,18 +3260,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2196,43 +3291,69 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
-      "marketplace_listing",
-      "integration",
-      "action"
-    ]
-  },
-  {
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "secondary_category",
+      "primary_category",
+      "operation_type",
+      "created_at",
+      "marketplace_listing",
+      "integration"
+    ]
+  },
+  {
     "action": "marketplace_listing.change_category",
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2240,22 +3361,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -2263,19 +3397,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -2286,21 +3433,36 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
       "marketplace_listing",
       "has_free_trial",
-      "user_agent",
-      "request_id",
-      "actor_id",
       "yearly_price_in_cents",
       "description",
       "bullets",
       "monthly_price_in_cents",
-      "marketplace_listing_plan",
-      "_document_id"
+      "marketplace_listing_plan"
     ]
   },
   {
@@ -2308,22 +3470,37 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "marketplace_listing_plan",
       "marketplace_listing",
       "description",
       "bullets",
       "has_free_trial",
       "created_at",
-      "actor_id",
       "operation_type",
-      "_document_id",
-      "action",
-      "user_agent",
-      "request_id",
-      "actor",
       "monthly_price_in_cents",
-      "yearly_price_in_cents",
-      "@timestamp"
+      "yearly_price_in_cents"
     ]
   },
   {
@@ -2331,21 +3508,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "marketplace_listing_plan",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "marketplace_listing_plan",
       "description",
       "yearly_price_in_cents",
-      "@timestamp",
       "created_at",
-      "actor_id",
       "bullets",
       "has_free_trial",
       "marketplace_listing",
-      "user_agent",
       "monthly_price_in_cents",
-      "action",
       "operation_type"
     ]
   },
@@ -2354,21 +3546,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "monthly_price_in_cents",
-      "marketplace_listing",
+      "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "monthly_price_in_cents",
+      "marketplace_listing",
       "description",
       "bullets",
       "yearly_price_in_cents",
-      "request_id",
-      "actor_id",
       "has_free_trial",
       "marketplace_listing_plan",
-      "user_agent",
-      "@timestamp",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -2377,22 +3584,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -2400,22 +3620,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2423,19 +3656,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2443,21 +3688,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2467,16 +3721,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2486,18 +3753,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2507,14 +3787,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2522,19 +3818,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -2542,18 +3849,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2561,23 +3880,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -2585,20 +3912,30 @@
     "description": "An OAuth access token was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
     "fields": [
-      "_document_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "user",
-      "user_id",
-      "created_at",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "request_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
@@ -2609,19 +3946,30 @@
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "explanation",
-      "hashed_token",
-      "actor_id",
-      "token_scopes",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
@@ -2631,19 +3979,30 @@
     "description": "An OAuth access token was regenerated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "_document_id",
-      "created_at",
       "@timestamp",
-      "operation_type",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ]
   },
@@ -2652,18 +4011,30 @@
     "description": "An OAuth access token was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2671,20 +4042,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2693,20 +4076,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2715,20 +4110,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2737,20 +4144,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2759,19 +4178,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2780,20 +4212,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2802,20 +4246,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2824,19 +4280,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2845,24 +4314,31 @@
     "description": "An authorization for an OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "user_id",
-      "actor",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
       "actor_id",
-      "user",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "actor_is_bot",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -2872,20 +4348,31 @@
     "description": "An authorization for an OAuth application was deleted.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "actor",
       "created_at",
       "explanation",
-      "user",
-      "user_id",
-      "org_id",
-      "action",
-      "actor_id",
-      "token_scopes",
       "actor_is_bot",
       "oauth_application_name"
     ],
@@ -2896,21 +4383,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -2919,24 +4416,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2944,20 +4451,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -2965,22 +4482,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -2988,20 +4513,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3009,22 +4544,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3032,21 +4575,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3054,26 +4606,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3081,28 +4641,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3110,26 +4678,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3137,20 +4713,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -3159,16 +4746,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -3179,18 +4779,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -3199,18 +4812,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -3219,18 +4844,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -3239,18 +4877,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -3260,20 +4910,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -3281,17 +4942,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -3301,20 +4975,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -3323,20 +5008,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -3345,17 +5044,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3366,20 +5080,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -3388,19 +5116,31 @@
     "description": "A new passkey was added.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3408,19 +5148,31 @@
     "description": "A new passkey was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3428,18 +5180,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3447,16 +5211,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3464,18 +5242,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3483,18 +5273,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3505,18 +5308,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3527,17 +5343,30 @@
     "description": "Triggered when you create a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3547,19 +5376,31 @@
     "description": "Triggered when you regenerate a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3567,12 +5408,29 @@
     "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
     "fields": [
-      "user_programmatic_access_name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
       "operation_type"
     ],
@@ -3583,20 +5441,32 @@
     "description": "Triggered when you delete a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "explanation",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3604,17 +5474,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -3625,18 +5508,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -3648,17 +5544,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -3670,17 +5579,30 @@
     "description": "A fine-grained personal access token was updated.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3691,15 +5613,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3709,17 +5646,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3729,15 +5677,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3747,17 +5710,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3767,17 +5741,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3787,17 +5772,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3807,17 +5803,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3827,17 +5834,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
-      "request_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -3847,17 +5867,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3865,20 +5898,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -3888,25 +5932,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -3914,20 +5970,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3935,25 +6003,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3961,17 +6041,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3979,17 +6072,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3997,18 +6103,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -4017,18 +6135,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -4037,19 +6167,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -4057,17 +6198,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -4079,22 +6233,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -4102,19 +6265,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4122,17 +6296,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4140,18 +6327,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -4159,20 +6359,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4180,18 +6390,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -4200,18 +6422,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -4220,17 +6454,30 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
+      "created_at",
       "operation_type",
       "project_kind",
       "project_name"
@@ -4241,21 +6488,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -4263,18 +6522,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4285,23 +6557,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -4310,24 +6593,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -4336,20 +6630,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4358,21 +6666,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -4382,22 +6703,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4406,25 +6739,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4433,23 +6776,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4458,22 +6812,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -4482,21 +6846,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -4505,25 +6878,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -4532,23 +6912,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -4557,24 +6945,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -4583,23 +6978,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -4609,22 +7012,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -4633,19 +7045,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -4654,24 +7079,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -4680,23 +7115,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4707,17 +7151,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -4726,15 +7183,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -4745,16 +7215,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -4764,17 +7247,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -4784,19 +7280,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -4805,17 +7312,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -4824,26 +7344,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -4852,30 +7378,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
-      "repo",
-      "user_id",
-      "visibility",
-      "repo_id",
-      "user",
-      "request_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_category",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "oauth_application_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "request_category",
+      "created_at",
+      "oauth_application_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -4885,20 +7416,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -4907,25 +7449,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -4934,23 +7484,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -4958,25 +7519,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -4986,23 +7556,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -5010,21 +7590,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5032,21 +7622,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -5054,22 +7654,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5077,21 +7686,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -5099,20 +7718,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5120,22 +7750,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5143,18 +7782,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5162,22 +7815,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5185,21 +7848,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5207,18 +7880,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -5227,22 +7912,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5251,49 +7945,67 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "Store information in variables"
-  },
-  {
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "public_repo",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "Store information in variables"
+  },
+  {
     "action": "repo.remove_integration_secret",
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5301,26 +8013,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -5329,21 +8046,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -5352,25 +8078,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5378,22 +8110,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -5402,19 +8144,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5422,23 +8175,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -5448,20 +8210,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -5472,21 +8245,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -5495,22 +8279,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -5519,21 +8313,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -5542,22 +8347,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -5568,16 +8383,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -5586,22 +8412,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -5611,22 +8446,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -5635,23 +8481,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5661,19 +8517,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -5681,22 +8547,32 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
-    ],
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
+    ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
   {
@@ -5704,24 +8580,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5729,25 +8614,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5756,24 +8648,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -5782,25 +8684,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5809,22 +8719,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -5833,26 +8752,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5860,31 +8787,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -5893,21 +8827,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -5915,21 +8859,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5937,21 +8891,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -5959,20 +8924,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5980,21 +8957,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6002,19 +8990,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -6022,31 +9023,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -6055,19 +9064,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -6075,8 +9095,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -6085,23 +9104,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -6126,18 +9154,30 @@
     "description": "A security key was registered for an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6145,18 +9185,30 @@
     "description": "A security key was removed from an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6164,16 +9216,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6183,18 +9248,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -6203,16 +9281,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6223,15 +9314,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -6241,15 +9345,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -6258,17 +9377,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -6277,17 +9409,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -6296,16 +9442,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -6315,14 +9474,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -6332,36 +9506,62 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
-      "user",
-      "operation_type",
-      "@timestamp",
-      "created_at",
       "actor_id",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
-  },
-  {
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
+  },
+  {
     "action": "sponsors.sponsored_developer_create",
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -6370,18 +9570,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6390,15 +9603,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -6408,16 +9635,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6425,15 +9665,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -6444,16 +9697,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -6463,17 +9729,30 @@
     "description": "Triggered when you send an email update to your sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
     "fields": [
-      "request_id",
-      "actor",
-      "action",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
   },
@@ -6482,17 +9761,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -6503,17 +9795,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -6524,18 +9829,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6545,16 +9861,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6564,17 +9893,30 @@
     "description": "You join the waitlist to join GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "actor_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -6583,16 +9925,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6602,23 +9957,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6626,23 +9991,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6650,23 +10025,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6674,23 +10059,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6698,15 +10093,30 @@
     "description": "Triggered when you accept a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6715,32 +10125,62 @@
     "description": "Triggered when you cancel a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
-  },
-  {
-    "action": "successor_invitation.create",
-    "description": "Triggered when you create a succession invitation.",
-    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
-    "fields": [
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
+  },
+  {
+    "action": "successor_invitation.create",
+    "description": "Triggered when you create a succession invitation.",
+    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6749,15 +10189,30 @@
     "description": "Triggered when you decline a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6766,15 +10221,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6782,15 +10252,30 @@
     "description": "Triggered when you revoke a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6799,17 +10284,30 @@
     "description": "A new trusted device was added.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6817,17 +10315,30 @@
     "description": "A trusted device was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6835,14 +10346,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "action",
-      "request_id",
-      "user_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -6851,15 +10377,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "created_at",
-      "user_id",
-      "operation_type",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6867,13 +10408,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "created_at",
-      "user_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6881,17 +10439,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "operation_type",
-      "action",
-      "_document_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6899,17 +10470,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6917,16 +10501,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6934,15 +10532,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "user",
       "_document_id",
-      "request_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6950,18 +10563,30 @@
     "description": "A secondary authentication factor was added to a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -6970,18 +10595,30 @@
     "description": "Two-factor authentication was disabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
     "fields": [
-      "actor",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_id",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Disabling two-factor authentication for your personal account"
   },
@@ -6990,18 +10627,30 @@
     "description": "Two-factor authentication was enabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
-      "actor",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Configuring two-factor authentication"
   },
@@ -7010,15 +10659,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user",
-      "user_id",
-      "action",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "user_agent"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7026,16 +10690,29 @@
     "description": "Two factor recovery codes were regenerated for a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
+      "operation_type",
       "created_at"
     ]
   },
@@ -7044,18 +10721,30 @@
     "description": "A secondary authentication factor was removed from a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -7064,15 +10753,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "operation_type",
-      "user_id",
-      "user",
-      "user_agent",
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7081,16 +10785,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "operation_type",
       "user_agent",
-      "action",
-      "request_id",
-      "actor",
-      "actor_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7098,19 +10815,31 @@
     "description": "An email address was added to a user account.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "actor_id",
-      "actor",
       "email",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding an email address to your GitHub account"
   },
@@ -7119,18 +10848,30 @@
     "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "created_at",
-      "user",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7138,15 +10879,28 @@
     "description": "Audit log entries were exported.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "action",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ]
@@ -7156,20 +10910,31 @@
     "description": "A user was blocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_id",
-      "_document_id",
       "actor_id",
-      "@timestamp",
-      "user_agent",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7177,18 +10942,30 @@
     "description": "A user changed their password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "actor_id",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7196,18 +10973,30 @@
     "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -7216,17 +11005,30 @@
     "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -7235,19 +11037,31 @@
     "description": "A new user account was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "email",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "created_at",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "programmatic_access_type"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "email",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7255,21 +11069,33 @@
     "description": "A user secret for Codespaces was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7277,20 +11103,31 @@
     "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "oauth_application_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "@timestamp",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -7298,18 +11135,30 @@
     "description": "A user account was destroyed by an asynchronous job.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7318,19 +11167,30 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "oauth_application_id",
+      "_document_id",
       "action",
-      "user",
-      "created_at",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7338,18 +11198,30 @@
     "description": "A user deleted his or her account, triggering user.async_delete.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
-      "created_at",
-      "user_agent",
       "user_id",
-      "operation_type",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7357,18 +11229,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "user_agent",
       "user_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7376,18 +11260,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "_document_id",
-      "@timestamp",
-      "user",
-      "actor_id",
-      "action",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7396,17 +11292,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "request_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7414,17 +11322,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7432,35 +11353,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ]
-  },
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
   {
     "action": "user.disable_sockpuppet_disallowed",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7468,21 +11415,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7490,21 +11447,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -7513,17 +11480,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7531,17 +11511,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7549,17 +11542,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7567,18 +11573,30 @@
     "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "org_id",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7586,17 +11604,31 @@
     "description": "A user requested a password reset.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
     "fields": [
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "email",
-      "created_at",
-      "user_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
   },
@@ -7605,17 +11637,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "created_at",
-      "user_agent",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "request_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7623,18 +11668,30 @@
     "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -7643,19 +11700,31 @@
     "description": "A user signed in.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "actor_id",
       "@timestamp",
-      "user",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "actor",
-      "passkey_nickname",
-      "request_access_security_header"
+      "passkey_nickname"
     ]
   },
   {
@@ -7663,18 +11732,30 @@
     "description": "A user signed out.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7682,18 +11763,30 @@
     "description": "A user signed in from a new device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7701,21 +11794,31 @@
     "description": "An ordinary user account was promoted to a site administrator.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
+      "user_id",
       "user_agent",
+      "created_at",
       "oauth_application_id",
-      "request_id",
-      "operation_type",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7723,16 +11826,29 @@
     "description": "A user's account was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user",
-      "action",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "operation_type"
     ]
   },
@@ -7741,20 +11857,31 @@
     "description": "An email address was removed from a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "actor_id",
       "created_at",
-      "email",
-      "token_scopes",
-      "programmatic_access_type"
+      "email"
     ]
   },
   {
@@ -7762,20 +11889,32 @@
     "description": "A user secret for Codespaces was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "key",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7783,20 +11922,31 @@
     "description": "A username was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "request_id",
-      "actor_id",
-      "old_login",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_login",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7804,18 +11954,30 @@
     "description": "A user reset their account password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7823,16 +11985,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -7843,16 +12018,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -7861,18 +12048,30 @@
     "description": "A user signed in from an unrecognized device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor",
-      "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7880,18 +12079,30 @@
     "description": "A user signed in from an unrecognized device and location.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "created_at",
-      "_document_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7899,22 +12110,33 @@
     "description": "Triggered when you clear the status on your profile.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "message",
-      "user",
-      "actor_id",
       "created_at",
-      "request_id",
       "limited_availability",
-      "action",
       "emoji",
-      "operation_type",
-      "user_agent",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7922,23 +12144,33 @@
     "description": "Triggered when you set or change the status on your profile.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
     "fields": [
-      "limited_availability",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "message",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "limited_availability",
+      "message",
+      "created_at",
       "emoji",
-      "org",
-      "actor",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
   },
@@ -7947,21 +12179,31 @@
     "description": "A user account was suspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "user_agent",
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "token_scopes",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7969,18 +12211,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
-      "actor_id",
       "@timestamp",
-      "operation_type",
       "_document_id",
-      "user_agent",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7988,18 +12242,30 @@
     "description": "A 2FA challenge issued for a user account failed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "actor_id",
-      "actor",
-      "user_id",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8009,35 +12275,59 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "actor",
-      "user_agent",
-      "request_id",
       "action",
-      "created_at",
-      "request_access_security_header"
-    ]
-  },
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
   {
     "action": "user.two_factor_recover",
     "description": "A user used their 2FA recovery codes.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8045,18 +12335,30 @@
     "description": "A user downloaded 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8064,17 +12366,30 @@
     "description": "A user printed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8082,18 +12397,30 @@
     "description": "A user viewed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
       "created_at",
-      "user",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8101,17 +12428,30 @@
     "description": "A user was prompted for a two-factor authentication code.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
     "fields": [
-      "user",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "actor"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
   },
@@ -8120,19 +12460,31 @@
     "description": "A user was unblocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "user_agent",
-      "user_id",
-      "user",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8140,21 +12492,31 @@
     "description": "A user account was unsuspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "user_agent",
       "actor",
-      "oauth_application_id",
-      "operation_type",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "user_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8162,21 +12524,33 @@
     "description": "A user secret for Codespaces was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8184,46 +12558,64 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "workflows.approve_workflow_job",
+    "description": "A workflow job was approved.",
+    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "workflows.approve_workflow_job",
-    "description": "A workflow job was approved.",
-    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
-    "fields": [
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "workflow_run_id",
       "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -8232,23 +12624,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8256,23 +12658,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8282,23 +12692,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -8307,22 +12729,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8330,21 +12763,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -8352,25 +12796,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8378,24 +12830,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -8404,25 +12865,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.16/enterprise.json b/src/audit-logs/data/ghes-3.16/enterprise.json
index 3baff923869f..ba6d85fc78da 100644
--- a/src/audit-logs/data/ghes-3.16/enterprise.json
+++ b/src/audit-logs/data/ghes-3.16/enterprise.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,17 +67,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
-      "user_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -61,18 +98,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
+      "token_scopes",
       "user",
-      "request_id",
-      "_document_id",
-      "user_agent",
-      "actor",
       "user_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -80,18 +129,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "token_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -99,29 +160,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -129,31 +196,34 @@
     "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "query_string",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "request_body",
-      "status_code",
-      "url_path",
       "business",
       "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "request_method",
+      "query_string",
+      "request_body",
+      "status_code",
+      "url_path",
+      "public_repo",
       "created_at",
       "operation_type",
       "route",
@@ -167,18 +237,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -186,20 +268,32 @@
     "description": "A manual check of the endpoint configured for audit log streaming was performed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "audit_log_stream_result",
-      "business_id",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_result",
       "created_at",
       "operation_type",
-      "audit_log_stream_sink_details",
-      "request_access_security_header"
+      "audit_log_stream_sink_details"
     ]
   },
   {
@@ -207,18 +301,31 @@
     "description": "An endpoint was added for audit log streaming.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "business_id",
       "business",
-      "audit_log_stream_sink",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_sink",
+      "created_at",
+      "operation_type",
       "audit_log_stream_id"
     ]
   },
@@ -227,15 +334,28 @@
     "description": "An audit log streaming endpoint was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "business_id",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "audit_log_stream_id",
@@ -247,17 +367,30 @@
     "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "audit_log_stream_enabled",
-      "business_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_enabled",
       "audit_log_stream_sink",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "new_s3_bucket",
@@ -280,17 +413,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -299,19 +445,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -320,18 +478,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -339,18 +510,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -358,15 +541,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -376,22 +572,31 @@
     "description": "An enterprise owner was added to an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
     "fields": [
-      "name",
-      "business",
-      "user",
-      "user_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "request_id",
+      "business",
       "business_id",
-      "_document_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Inviting people to manage your enterprise"
   },
@@ -400,22 +605,32 @@
     "description": "An organization was added to an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "operation_type",
       "name",
       "created_at",
-      "request_id",
-      "_document_id",
-      "business",
-      "organization_upgrade",
-      "request_access_security_header"
+      "organization_upgrade"
     ]
   },
   {
@@ -423,20 +638,30 @@
     "description": "GitHub Advanced Security was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -445,17 +670,28 @@
     "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -466,21 +702,31 @@
     "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -489,17 +735,28 @@
     "description": "GitHub Advanced Security was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -510,17 +767,28 @@
     "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -531,21 +799,31 @@
     "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -554,20 +832,32 @@
     "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "new_policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "new_policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -576,20 +866,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -597,17 +899,28 @@
     "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -619,21 +932,31 @@
     "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -642,18 +965,31 @@
     "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -662,17 +998,30 @@
     "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
     "fields": [
-      "name",
-      "operation_type",
-      "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "actor",
+      "@timestamp",
       "_document_id",
-      "business",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -682,19 +1031,32 @@
     "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
-      "action",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "business",
       "visibility",
       "created_at",
-      "actor",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -703,21 +1065,33 @@
     "description": "The policy for Code scanning autofix was updated for an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -725,21 +1099,33 @@
     "description": "The policy for Code scanning autofix third party tools was updated for an enterprise.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/getting-started/github-security-features#available-with-github-code-security"
   },
@@ -748,19 +1134,31 @@
     "description": "An enterprise was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "request_id",
-      "name",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "operation_type",
-      "actor",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -768,17 +1166,28 @@
     "description": "Dependabot alerts were disabled for new repositories in your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -788,17 +1197,28 @@
     "description": "Dependabot alerts were enabled for new repositories in your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -808,17 +1228,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -828,18 +1261,30 @@
     "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -847,17 +1292,28 @@
     "description": "Display of IP addresses within audit log events for the enterprise was disabled.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -868,18 +1324,31 @@
     "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "business_id",
-      "actor_id",
-      "name",
-      "_document_id",
-      "request_id"
+      "name"
     ]
   },
   {
@@ -887,15 +1356,28 @@
     "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -905,17 +1387,28 @@
     "description": "Display of IP addresses within audit log events for the enterprise was enabled.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -926,18 +1419,31 @@
     "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "operation_type",
-      "created_at",
+      "actor_id",
       "business",
       "business_id",
-      "name",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ]
   },
   {
@@ -945,20 +1451,31 @@
     "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
       "business",
-      "name",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "business_id",
-      "_document_id"
+      "created_at",
+      "name",
+      "operation_type"
     ]
   },
   {
@@ -966,20 +1483,31 @@
     "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -987,20 +1515,31 @@
     "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "business",
-      "actor_id",
-      "created_at",
-      "action",
+      "user_id",
       "user_agent",
-      "request_id",
-      "user_id"
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1008,20 +1547,31 @@
     "description": "An enterprise owner was removed from an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
-      "user_agent",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "name",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
-      "user"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ],
     "docs_reference_titles": "Inviting people to manage your enterprise"
   },
@@ -1030,20 +1580,31 @@
     "description": "An organization was removed from an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "business",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "business_id",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "name",
-      "org"
+      "name"
     ]
   },
   {
@@ -1051,18 +1612,31 @@
     "description": "The slug for the enterprise URL was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "name",
-      "business_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
-      "@timestamp",
-      "created_at",
+      "actor_id",
       "business",
-      "_document_id"
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1070,20 +1644,31 @@
     "description": "The SAML single sign-on session for a member in an enterprise was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "_document_id",
-      "actor_id",
       "name",
-      "@timestamp",
-      "user_id",
-      "action",
-      "created_at",
-      "business"
+      "created_at"
     ]
   },
   {
@@ -1091,17 +1676,28 @@
     "description": "Automatic partner validation checks have been disabled at the business level",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1112,17 +1708,28 @@
     "description": "Automatic partner validation checks have been enabled at the business level",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1133,20 +1740,30 @@
     "description": "An enterprise-level custom pattern was created for secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -1155,17 +1772,28 @@
     "description": "An enterprise-level custom pattern was removed from secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1175,20 +1803,30 @@
     "description": "An enterprise-level custom pattern was published for secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1196,17 +1834,28 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1217,20 +1866,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -1239,17 +1898,28 @@
     "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1259,17 +1929,28 @@
     "description": "Secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1280,17 +1961,28 @@
     "description": "Secret scanning was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1301,17 +1993,28 @@
     "description": "Secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1322,17 +2025,28 @@
     "description": "Secret scanning was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1343,17 +2057,28 @@
     "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1365,17 +2090,28 @@
     "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1387,17 +2123,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1408,17 +2155,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1429,17 +2187,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1450,17 +2219,28 @@
     "description": "Push protection for secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1471,17 +2251,28 @@
     "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1492,17 +2283,28 @@
     "description": "Push protection for secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1513,17 +2315,28 @@
     "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1534,20 +2347,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1555,26 +2380,36 @@
     "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1582,24 +2417,34 @@
     "description": "A CSV export was requested on the \"Coverage\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1607,26 +2452,36 @@
     "description": "A CSV export was requested on the \"Overview Dashboard\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1634,20 +2489,31 @@
     "description": "A CSV export was requested on the \"Risk\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1658,17 +2524,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -1679,20 +2558,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1701,19 +2592,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1722,41 +2626,65 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
-  },
-  {
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+  },
+  {
     "action": "business.set_fork_pr_workflows_policy",
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1765,19 +2693,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1786,20 +2726,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "issuer",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
       "business_id",
-      "actor_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "issuer",
+      "name",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1807,18 +2759,31 @@
     "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "updated_github_owned_allowed",
       "updated_verified_allowed",
       "updated_patterns",
@@ -1833,20 +2798,33 @@
     "description": "The base repository permission setting was updated for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
     "fields": [
-      "business_id",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "permission",
-      "action",
       "created_at",
-      "@timestamp",
-      "request_id",
       "name",
-      "_document_id",
-      "old_permission",
-      "business"
+      "old_permission"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -1855,19 +2833,32 @@
     "description": "The repository creation setting was updated for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "name",
-      "business_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "operation_type",
-      "permission",
-      "action",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "name",
+      "operation_type",
+      "permission",
       "visibility"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -1877,19 +2868,32 @@
     "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories",
     "fields": [
-      "business_id",
-      "created_at",
-      "action",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "permission",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "business"
+      "created_at",
+      "operation_type",
+      "permission",
+      "name"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -1898,20 +2902,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -1920,20 +2935,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -1944,17 +2970,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1962,15 +3000,31 @@
     "description": "Existing code scanning alerts appeared in a branch.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -1980,15 +3034,31 @@
     "description": "Code scanning alerts were fixed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -1998,15 +3068,29 @@
     "description": "Code scanning alerts were manually dismissed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers",
       "dismissal_approver_id"
     ],
@@ -2017,13 +3101,31 @@
     "description": "Code scanning alerts were seen for the first time.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2033,15 +3135,31 @@
     "description": "Code scanning alerts that were previously fixed reappeared.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2051,15 +3169,29 @@
     "description": "Code scanning alerts that were previously dismissed were reopened.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2069,14 +3201,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2086,25 +3233,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -2115,22 +3271,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -2142,22 +3309,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -2166,15 +3344,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -2185,17 +3378,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2205,27 +3411,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "org",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2233,19 +3448,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -2253,18 +3481,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -2273,23 +3513,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2297,16 +3544,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -2315,24 +3576,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2340,15 +3607,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2358,20 +3638,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2379,19 +3669,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -2399,21 +3701,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -2421,21 +3732,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2445,19 +3765,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2467,21 +3796,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2491,18 +3829,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -2515,18 +3866,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -2540,14 +3904,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -2560,8 +3939,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2570,27 +3948,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2599,19 +3985,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2620,16 +4018,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "definition_id"
@@ -2641,19 +4052,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -2662,19 +4084,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -2683,19 +4116,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -2704,19 +4148,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -2725,17 +4180,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2743,40 +4211,62 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
-  },
-  {
-    "action": "dependabot_security_updates.enable",
-    "description": "Dependabot security updates were enabled for all existing repositories.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
+      "user_agent",
       "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+  },
+  {
+    "action": "dependabot_security_updates.enable",
+    "description": "Dependabot security updates were enabled for all existing repositories.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "_document_id"
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2784,19 +4274,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -2805,19 +4306,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2825,19 +4337,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -2846,19 +4369,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2866,19 +4400,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -2887,20 +4432,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2908,21 +4463,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "team",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "number",
-      "org",
-      "title",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id"
+      "team",
+      "created_at",
+      "number",
+      "title",
+      "operation_type"
     ]
   },
   {
@@ -2930,18 +4497,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
-      "user_agent",
-      "operation_type",
-      "user_id",
+      "_document_id",
+      "action",
       "actor",
-      "number",
-      "user",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "number",
+      "created_at"
     ]
   },
   {
@@ -2949,18 +4529,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "_document_id",
-      "request_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "number",
       "team",
       "created_at"
@@ -2971,21 +4562,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "_document_id",
-      "title",
-      "user",
-      "user_agent",
-      "org",
-      "operation_type",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "team",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type",
+      "team",
       "number"
     ]
   },
@@ -2994,17 +4596,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3015,16 +4631,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3035,18 +4665,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
       "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3057,23 +4701,31 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise"
   },
@@ -3082,19 +4734,33 @@
     "description": "A domain was approved for an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3103,18 +4769,33 @@
     "description": "A domain was added to an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3123,18 +4804,33 @@
     "description": "A domain was removed from an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3143,18 +4839,33 @@
     "description": "A domain was verified for an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3163,18 +4874,30 @@
     "description": "A new GitHub Actions self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -3183,20 +4906,30 @@
     "description": "A GitHub Actions self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -3205,18 +4938,31 @@
     "description": "A GitHub Actions self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
@@ -3226,18 +4972,31 @@
     "description": "A GitHub Actions self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3246,20 +5005,33 @@
     "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -3268,19 +5040,31 @@
     "description": "A GitHub Actions self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3289,19 +5073,32 @@
     "description": "A GitHub Actions runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -3310,24 +5107,36 @@
     "description": "The configuration of a GitHub Actions self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3336,30 +5145,66 @@
     "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "business_id",
-      "runner_id",
-      "runner_name",
-      "action",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "@timestamp"
-    ],
-    "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
-  },
-  {
-    "action": "enterprise.self_hosted_runner_online",
-    "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_id",
+      "runner_name",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
+  },
+  {
+    "action": "enterprise.self_hosted_runner_online",
+    "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -3368,18 +5213,36 @@
     "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
       "target_version",
       "runner_group_id",
       "runner_group_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Self-hosted runners"
   },
@@ -3388,22 +5251,32 @@
     "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "business_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "user",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3411,21 +5284,33 @@
     "description": "A license for GitHub Copilot was assigned to an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3433,17 +5318,30 @@
     "description": "A license for GitHub Copilot was unassigned from an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3454,17 +5352,30 @@
     "description": "A new enterprise team was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3474,17 +5385,30 @@
     "description": "An enterprise team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3495,22 +5419,32 @@
     "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "business_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "user",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3518,18 +5452,31 @@
     "description": "The name of an enterprise team was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "business_id",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3540,22 +5487,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3564,22 +5520,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3587,28 +5553,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3617,27 +5589,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -3646,25 +5626,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3673,26 +5661,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3701,21 +5696,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -3724,22 +5731,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3748,25 +5765,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3775,22 +5801,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -3799,21 +5837,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -3824,27 +5872,33 @@
     "description": "A user was added to an external group.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "external_group",
-      "external_group_id",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "external_group",
+      "external_group_id",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -3852,19 +5906,31 @@
     "description": "An external group was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at",
       "scim_group_id"
     ]
   },
@@ -3873,22 +5939,33 @@
     "description": "An external group was linked to a GitHub team.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "external_group",
-      "programmatic_access_type",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -3896,21 +5973,31 @@
     "description": "An external group was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3918,26 +6005,32 @@
     "description": "A user was removed from an external group.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "external_group",
-      "external_group_id",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "external_group",
+      "external_group_id",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3945,15 +6038,29 @@
     "description": "Failed external group SCIM API request.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
@@ -3961,15 +6068,9 @@
       "url_path",
       "scim_group_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -3978,30 +6079,38 @@
     "description": "Successful external group SCIM API request. Excludes GET API requests.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4010,18 +6119,31 @@
     "description": "An external group was unlinked to a GitHub team.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "external_group"
     ]
   },
@@ -4030,22 +6152,32 @@
     "description": "An external group was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "scim_group_id",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at",
+      "scim_group_id"
     ]
   },
   {
@@ -4053,25 +6185,33 @@
     "description": "An external group's display name was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
       "external_group",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -4079,20 +6219,31 @@
     "description": "An external identity was deprovisioned, suspending the linked GitHub user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -4100,17 +6251,31 @@
     "description": "An external identity was created and linked to a GitHub user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "scim_user_id",
-      "request_access_security_header"
+      "scim_user_id"
     ]
   },
   {
@@ -4118,15 +6283,29 @@
     "description": "Failed external identity SCIM API request.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
@@ -4134,15 +6313,9 @@
       "url_path",
       "scim_user_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4151,30 +6324,38 @@
     "description": "Successful external identity SCIM API request. Excludes GET API requests.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4183,18 +6364,31 @@
     "description": "An external identity was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "action",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "token_scopes",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "scim_user_id",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "scim_user_id"
     ]
   },
   {
@@ -4202,21 +6396,32 @@
     "description": "A gist was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "gist_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "visibility",
-      "action",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ]
   },
   {
@@ -4224,20 +6429,32 @@
     "description": "A gist was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "gist_id",
-      "visibility",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "user",
-      "request_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "programmatic_access_type"
+      "gist_id",
+      "visibility",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4245,21 +6462,32 @@
     "description": "The visibility of a gist was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "user",
-      "gist_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "visibility",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "gist_id",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -4267,19 +6495,30 @@
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4288,20 +6527,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4310,19 +6559,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4331,22 +6591,33 @@
     "description": "An SSH key was added to a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -4355,23 +6626,34 @@
     "description": "An SSH key was removed from a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
       "explanation",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -4380,42 +6662,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "github_hosted_runner.destroy",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "github_hosted_runner.destroy",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4426,20 +6727,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -4449,18 +6760,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "user",
-      "operation_type",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4468,18 +6791,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4487,25 +6822,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -4513,25 +6858,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -4539,26 +6893,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -4567,25 +6930,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -4593,26 +6965,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
-      "repo",
-      "operation_type",
-      "action",
-      "_document_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
+      "operation_type",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -4620,21 +7001,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -4643,19 +7035,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -4663,21 +7068,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -4686,19 +7102,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -4709,20 +7139,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -4732,24 +7174,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -4760,23 +7213,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -4787,20 +7252,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -4810,19 +7288,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -4831,20 +7323,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -4854,20 +7359,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -4876,20 +7394,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -4898,20 +7429,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -4919,19 +7462,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -4940,19 +7496,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -4961,17 +7530,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -4984,21 +7566,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -5012,17 +7607,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -5034,19 +7642,30 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "user"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5054,19 +7673,30 @@
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5074,17 +7704,28 @@
     "description": "IP allow list user level enforcement was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5094,20 +7735,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "user_id",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
-      "_document_id",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "actor_id",
       "operation_type",
-      "org",
       "created_at"
     ]
   },
@@ -5116,19 +7766,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5136,17 +7797,28 @@
     "description": "IP allow list user level enforcement was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5156,24 +7828,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5181,24 +7861,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "ip_allow_list_entry",
-      "org",
-      "operation_type",
-      "created_at",
-      "active",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at",
+      "active"
     ]
   },
   {
@@ -5206,19 +7894,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "actor_id",
       "ip_allow_list_entry",
-      "active",
-      "org_id",
-      "@timestamp"
+      "active"
     ]
   },
   {
@@ -5226,18 +7927,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5245,21 +7958,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -5267,21 +7993,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5289,22 +8028,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -5312,19 +8064,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -5335,21 +8100,36 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
       "marketplace_listing",
       "has_free_trial",
-      "user_agent",
-      "request_id",
-      "actor_id",
       "yearly_price_in_cents",
       "description",
       "bullets",
       "monthly_price_in_cents",
-      "marketplace_listing_plan",
-      "_document_id"
+      "marketplace_listing_plan"
     ]
   },
   {
@@ -5357,22 +8137,37 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "marketplace_listing_plan",
       "marketplace_listing",
       "description",
       "bullets",
       "has_free_trial",
       "created_at",
-      "actor_id",
       "operation_type",
-      "_document_id",
-      "action",
-      "user_agent",
-      "request_id",
-      "actor",
       "monthly_price_in_cents",
-      "yearly_price_in_cents",
-      "@timestamp"
+      "yearly_price_in_cents"
     ]
   },
   {
@@ -5380,21 +8175,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "marketplace_listing_plan",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "marketplace_listing_plan",
       "description",
       "yearly_price_in_cents",
-      "@timestamp",
       "created_at",
-      "actor_id",
       "bullets",
       "has_free_trial",
       "marketplace_listing",
-      "user_agent",
       "monthly_price_in_cents",
-      "action",
       "operation_type"
     ]
   },
@@ -5403,45 +8213,73 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "monthly_price_in_cents",
-      "marketplace_listing",
+      "@timestamp",
       "_document_id",
       "action",
-      "description",
-      "bullets",
-      "yearly_price_in_cents",
-      "request_id",
-      "actor_id",
-      "has_free_trial",
-      "marketplace_listing_plan",
-      "user_agent",
-      "@timestamp",
-      "operation_type",
       "actor",
-      "created_at"
-    ]
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "monthly_price_in_cents",
+      "marketplace_listing",
+      "description",
+      "bullets",
+      "yearly_price_in_cents",
+      "has_free_trial",
+      "marketplace_listing_plan",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "marketplace_listing.redraft",
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -5449,22 +8287,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5472,19 +8323,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5492,21 +8355,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5516,16 +8388,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5535,18 +8420,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5556,14 +8454,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5571,19 +8485,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -5591,42 +8516,62 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "org",
-      "created_at",
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "migration.create",
-    "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "repo",
-      "org_id",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "migration.create",
+    "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "user_agent",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -5634,20 +8579,30 @@
     "description": "An OAuth access token was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
     "fields": [
-      "_document_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "user",
-      "user_id",
-      "created_at",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "request_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
@@ -5658,19 +8613,30 @@
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "explanation",
-      "hashed_token",
-      "actor_id",
-      "token_scopes",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
@@ -5680,19 +8646,30 @@
     "description": "An OAuth access token was regenerated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "_document_id",
-      "created_at",
       "@timestamp",
-      "operation_type",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ]
   },
@@ -5701,18 +8678,30 @@
     "description": "An OAuth access token was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5720,20 +8709,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5742,20 +8743,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5764,20 +8777,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5786,20 +8811,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5808,19 +8845,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5829,20 +8879,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5851,20 +8913,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5874,18 +8948,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "org_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "oauth_application_id",
-      "action",
       "created_at",
-      "actor",
-      "actor_id",
-      "oauth_application",
-      "_document_id",
-      "request_id"
+      "oauth_application"
     ]
   },
   {
@@ -5893,19 +8980,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5914,15 +9014,32 @@
     "description": "An OAuth application was unsuspended for a user or organization account.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "operation_type",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "oauth_application_id",
       "oauth_application",
-      "org",
-      "created_at",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5931,24 +9048,31 @@
     "description": "An authorization for an OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "user_id",
-      "actor",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
       "actor_id",
-      "user",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "actor_is_bot",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -5958,20 +9082,31 @@
     "description": "An authorization for an OAuth application was deleted.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "actor",
       "created_at",
       "explanation",
-      "user",
-      "user_id",
-      "org_id",
-      "action",
-      "actor_id",
-      "token_scopes",
       "actor_is_bot",
       "oauth_application_name"
     ],
@@ -5982,20 +9117,31 @@
     "description": "An authorization for an OAuth application was updated.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "org_id",
-      "request_id",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
       "operation_type",
-      "action",
-      "user",
       "created_at",
-      "_document_id",
       "actor_is_bot",
-      "request_access_security_header",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -6005,17 +9151,28 @@
     "description": "An invitation sent to an organization to join an enterprise was accepted.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6026,20 +9183,30 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
   },
@@ -6048,21 +9215,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -6071,24 +9248,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6096,21 +9283,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -6118,20 +9315,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6139,22 +9346,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6162,20 +9377,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6183,42 +9408,61 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
-    ]
-  },
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
   {
     "action": "org.advanced_security_policy_selected_member_disabled",
     "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -6227,19 +9471,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -6249,16 +9504,29 @@
     "description": "A user initiated a background job to delete an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ]
   },
@@ -6267,16 +9535,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -6285,18 +9566,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
-      "actor",
-      "user_agent",
-      "org_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "blocked_user",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -6305,19 +9599,30 @@
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -6327,22 +9632,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "email",
-      "@timestamp",
-      "actor",
-      "action",
       "operation_type",
-      "user_agent",
-      "org",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -6350,19 +9666,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -6370,23 +9697,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6394,21 +9729,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6416,23 +9761,31 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6440,23 +9793,31 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6464,21 +9825,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -6487,21 +9857,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -6510,16 +9889,29 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
@@ -6529,17 +9921,30 @@
     "description": "The interaction limit for prior contributors only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6548,17 +9953,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6568,16 +9986,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6586,17 +10017,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6605,17 +10049,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6624,22 +10081,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -6648,17 +10113,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6669,18 +10145,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
-      "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -6689,18 +10177,30 @@
     "description": "An organization was deleted by a user or staff.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "org_id",
-      "org",
       "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6708,20 +10208,30 @@
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -6730,19 +10240,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -6751,14 +10272,31 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sso_url",
       "issuer",
-      "action",
-      "@timestamp",
-      "_document_id",
       "created_at",
-      "org",
       "operation_type"
     ]
   },
@@ -6767,17 +10305,30 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6785,19 +10336,30 @@
     "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6805,19 +10367,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user_agent",
-      "request_id",
-      "actor",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
       "action",
+      "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6825,19 +10398,30 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -6846,19 +10430,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -6867,19 +10462,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "sso_url",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "issuer",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "sso_url",
+      "created_at",
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -6888,17 +10496,30 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
   },
@@ -6907,17 +10528,30 @@
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -6926,18 +10560,31 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
-      "org",
-      "user_agent",
-      "request_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "manager",
       "operation_type",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6945,23 +10592,32 @@
     "description": "A new user was invited to join an organization.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
     "fields": [
-      "org",
-      "user_id",
-      "invitation_id",
-      "org_id",
-      "user",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -6970,17 +10626,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6990,19 +10657,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7010,19 +10688,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7031,16 +10720,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7048,17 +10750,30 @@
     "description": "An organization was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7066,19 +10781,31 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -7087,18 +10814,29 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
@@ -7108,21 +10846,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7130,21 +10877,30 @@
     "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user",
-      "org_id",
-      "created_at",
-      "request_id",
       "@timestamp",
-      "action",
-      "operation_type",
-      "user_agent",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7152,21 +10908,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -7174,18 +10940,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -7194,19 +10972,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
-      "old_login",
-      "org_id",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_login",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7214,20 +11004,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -7236,21 +11036,33 @@
     "description": "A self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -7260,21 +11072,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7283,23 +11105,33 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -7308,23 +11140,31 @@
     "description": "A self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7333,19 +11173,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -7354,25 +11207,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7381,21 +11245,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7405,21 +11278,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7429,20 +11311,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7451,22 +11343,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7475,21 +11375,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7498,21 +11407,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7521,22 +11439,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7545,21 +11471,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7568,21 +11503,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7592,21 +11536,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7616,19 +11569,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7638,21 +11602,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7662,21 +11635,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7686,19 +11668,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7708,22 +11701,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7732,22 +11733,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7756,22 +11765,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7780,21 +11797,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7803,21 +11829,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7826,22 +11861,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7850,22 +11893,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "token_scopes"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7874,26 +11925,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -7902,26 +11962,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7929,28 +11997,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7958,26 +12034,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7985,15 +12069,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -8002,15 +12103,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -8019,7 +12137,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -8034,20 +12173,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -8056,16 +12206,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -8076,18 +12239,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -8096,17 +12272,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8114,18 +12303,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -8134,18 +12335,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -8154,18 +12368,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -8174,22 +12400,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issuer",
-      "business",
       "operation_type",
       "created_at",
-      "request_id",
-      "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8197,19 +12433,31 @@
     "description": "A user account was converted into an organization.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization",
     "fields": [
-      "actor",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "@timestamp",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "owner",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "owner"
     ],
     "docs_reference_titles": "Converting a user into an organization"
   },
@@ -8218,19 +12466,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
-      "oauth_application_id",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "blocked_user",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -8239,23 +12500,34 @@
     "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -8264,20 +12536,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -8286,20 +12570,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -8307,17 +12602,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -8327,20 +12635,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -8349,19 +12668,32 @@
     "description": "An organization's SAML provider settings were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "issuer",
-      "org",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -8369,18 +12701,30 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "org",
-      "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
@@ -8389,20 +12733,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "org_id",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -8411,16 +12768,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8429,14 +12801,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -8447,16 +12834,31 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "operation_type",
-      "domain_name",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
       "_document_id",
-      "actor_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "domain_name",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8465,20 +12867,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "package",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "package",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -8488,23 +12901,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8513,21 +12937,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -8538,21 +12973,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8561,20 +13009,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8583,17 +13045,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8604,20 +13081,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8626,19 +13117,31 @@
     "description": "A new passkey was added.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8646,19 +13149,31 @@
     "description": "A new passkey was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8666,18 +13181,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8685,35 +13212,61 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "payment_method.update",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "payment_method.update",
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8721,18 +13274,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8743,18 +13309,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8765,17 +13344,30 @@
     "description": "Triggered when you create a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8785,19 +13377,31 @@
     "description": "Triggered when you regenerate a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8805,12 +13409,29 @@
     "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
     "fields": [
-      "user_programmatic_access_name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
       "operation_type"
     ],
@@ -8821,20 +13442,32 @@
     "description": "Triggered when you delete a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "explanation",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8842,23 +13475,34 @@
     "description": "A personal access token expiration limit was set.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "token_expiration",
       "old_token_expiration",
       "exempt_administrators",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8866,39 +13510,63 @@
     "description": "A personal access token expiration limit was unset.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "programmatic_access_type",
-      "old_token_expiration",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "personal_access_token.request_cancelled",
-    "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_token_expiration",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
+    ]
+  },
+  {
+    "action": "personal_access_token.request_cancelled",
+    "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8909,18 +13577,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8932,17 +13613,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8954,17 +13648,30 @@
     "description": "A fine-grained personal access token was updated.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8975,15 +13682,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8993,17 +13715,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9013,15 +13746,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9031,17 +13779,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9051,17 +13810,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9071,17 +13841,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9091,17 +13872,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9111,17 +13903,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -9131,17 +13936,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9149,20 +13967,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -9172,25 +14001,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -9198,20 +14039,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9219,25 +14072,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9245,17 +14110,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9263,17 +14141,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9281,18 +14172,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -9301,18 +14204,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -9321,19 +14236,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -9341,17 +14267,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -9363,22 +14302,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -9386,19 +14334,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9406,17 +14365,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9424,18 +14396,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -9443,20 +14428,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9464,38 +14459,62 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
   {
     "action": "project_view.delete",
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -9504,16 +14523,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -9525,21 +14557,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -9547,22 +14591,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -9571,29 +14625,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9601,24 +14660,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "repo_id",
-      "user_id",
       "@timestamp",
-      "user_agent",
-      "repo",
-      "name",
-      "org_id",
-      "user",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -9629,21 +14696,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -9654,22 +14731,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -9677,24 +14764,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "oauth_application_id",
-      "authorized_actors_only",
-      "authorized_actors",
-      "created_at",
-      "user_agent",
-      "name",
-      "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "authorized_actors_only",
+      "authorized_actors",
+      "created_at",
+      "name",
+      "operation_type"
     ]
   },
   {
@@ -9702,30 +14799,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -9735,28 +14839,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -9767,23 +14879,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -9791,22 +14912,32 @@
     "description": "Branch deletion was enabled or disabled for a protected branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "operation_type",
-      "request_id",
-      "repo",
       "@timestamp",
-      "org_id",
-      "org",
-      "action",
-      "allow_deletions_enforcement_level",
       "_document_id",
-      "created_at",
-      "actor_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_deletions_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -9814,23 +14945,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "actor_id",
-      "name",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo",
-      "operation_type",
-      "request_id",
-      "allow_force_pushes_enforcement_level",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_force_pushes_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -9838,24 +14978,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -9864,22 +15013,32 @@
     "description": "Required linear commit history was enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "operation_type",
       "actor",
-      "linear_history_requirement_enforcement_level",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "linear_history_requirement_enforcement_level",
       "name",
-      "org_id",
-      "repo_id",
-      "org",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -9887,24 +15046,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "lock_allows_fetch_and_merge",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -9913,27 +15081,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -9942,18 +15117,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9964,24 +15152,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -9989,25 +15186,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -10015,22 +15219,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -10038,22 +15252,33 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
   },
@@ -10062,22 +15287,32 @@
     "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "required_approving_review_count",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10085,25 +15320,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
     ]
   },
   {
@@ -10111,22 +15353,32 @@
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
       "action",
       "actor",
       "actor_id",
-      "signature_requirement_enforcement_level",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "programmatic_access_type"
+      "operation_type",
+      "name",
+      "created_at",
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -10134,22 +15386,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "created_at",
-      "repo_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "name",
-      "actor",
-      "repo",
       "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
+      "strict_required_status_checks_policy"
     ]
   },
   {
@@ -10157,23 +15419,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -10182,24 +15455,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -10208,20 +15492,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10230,21 +15528,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -10254,22 +15565,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10278,25 +15601,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10305,23 +15638,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
-      "created_at",
-      "key",
-      "fingerprint",
-      "actor_id",
       "actor",
-      "title",
-      "user_agent",
-      "user_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "read_only",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "key",
+      "fingerprint",
+      "title",
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10330,18 +15674,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -10351,21 +15709,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -10374,19 +15743,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -10397,23 +15779,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -10423,17 +15817,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -10441,19 +15849,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -10461,19 +15882,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -10483,21 +15917,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -10506,27 +15951,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
-      "pull_request_url",
-      "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
+      "pull_request_url",
+      "pull_request_title",
+      "public_repo",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -10534,23 +15986,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -10559,18 +16023,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -10578,19 +16056,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -10600,20 +16090,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
-      "repo",
-      "created_at",
-      "request_id",
-      "comment_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "comment_id",
+      "operation_type"
     ]
   },
   {
@@ -10621,18 +16122,31 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "_document_id",
-      "@timestamp",
-      "comment_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "comment_id"
     ]
   },
   {
@@ -10640,21 +16154,33 @@
     "description": "A review on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -10662,20 +16188,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -10684,19 +16223,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -10706,22 +16259,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "created_at",
-      "user_agent",
-      "actor",
+      "_document_id",
       "action",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -10730,21 +16293,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -10753,25 +16325,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -10780,23 +16359,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -10805,24 +16392,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -10831,23 +16425,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -10857,22 +16459,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -10881,19 +16492,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -10902,24 +16526,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -10928,24 +16562,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -10953,24 +16595,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -10978,24 +16628,32 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11003,24 +16661,32 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11028,23 +16694,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11055,25 +16730,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11082,26 +16763,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11110,25 +16799,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "query_suite",
       "threat_model",
       "languages",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -11138,20 +16836,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "visibility",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11159,18 +16868,31 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "actor",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
-    ],
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
   {
@@ -11178,15 +16900,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -11197,16 +16932,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11216,17 +16964,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11236,19 +16997,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11257,17 +17029,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11276,26 +17061,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -11304,30 +17095,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -11337,20 +17133,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -11359,25 +17166,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -11386,23 +17201,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11410,25 +17236,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -11438,17 +17273,30 @@
     "description": "A repository was archived on disk.",
     "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
-      "repo_id",
-      "actor",
       "action",
-      "user_agent"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository/archiving-repositories"
   },
@@ -11457,23 +17305,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -11483,20 +17340,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "visibility",
-      "repo_id",
-      "created_at",
-      "actor",
-      "action",
-      "@timestamp",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -11504,20 +17372,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
-      "repo_id",
-      "request_id",
-      "action",
-      "_document_id",
       "@timestamp",
-      "actor_id",
-      "created_at",
-      "user",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
       "public_repo"
     ]
   },
@@ -11526,19 +17405,30 @@
     "description": "The repository was unlocked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11546,20 +17436,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "action",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "operation_type",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "visibility",
-      "actor",
-      "user_id"
+      "visibility"
     ]
   },
   {
@@ -11567,23 +17468,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
-      "repo",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -11591,21 +17502,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11613,21 +17534,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -11635,22 +17566,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -11658,21 +17598,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -11680,20 +17630,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11701,22 +17662,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11724,18 +17694,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11743,22 +17727,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11766,21 +17760,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11788,18 +17792,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -11808,22 +17824,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -11832,24 +17857,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -11858,23 +17891,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11882,26 +17925,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -11910,21 +17958,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -11933,25 +17990,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11959,22 +18022,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
-      "actor",
-      "old_name",
-      "repo",
-      "user_id",
-      "created_at",
-      "user",
+      "_document_id",
       "action",
-      "operation_type",
-      "visibility",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -11983,20 +18056,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "visibility",
-      "operation_type",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "@timestamp",
-      "request_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -12004,19 +18088,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12024,17 +18119,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12043,17 +18153,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12062,7 +18187,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -12077,23 +18223,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -12103,20 +18258,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -12127,21 +18293,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -12150,22 +18327,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -12174,21 +18361,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -12197,22 +18395,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -12223,16 +18431,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -12241,22 +18460,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -12266,22 +18494,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -12290,23 +18529,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12316,19 +18565,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -12336,21 +18595,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -12359,24 +18628,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -12384,25 +18662,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12411,24 +18696,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12437,25 +18732,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12464,22 +18767,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12488,26 +18800,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12515,31 +18835,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12548,24 +18875,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -12574,24 +18907,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -12600,43 +18939,63 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
-      "user",
-      "user_id",
-      "request_access_security_header"
-    ]
-  },
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
+    ]
+  },
   {
     "action": "repository_image.destroy",
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12644,21 +19003,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -12666,20 +19036,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -12687,21 +19069,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12709,19 +19102,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -12729,31 +19135,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -12762,19 +19176,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -12782,8 +19207,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -12792,23 +19216,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -12833,26 +19266,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -12861,26 +19300,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -12889,23 +19334,30 @@
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12915,23 +19367,30 @@
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12941,24 +19400,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12968,24 +19434,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -12994,24 +19467,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13021,23 +19501,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13047,23 +19534,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13072,22 +19567,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13095,24 +19598,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -13121,24 +19632,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -13147,19 +19666,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13168,24 +19699,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13194,24 +19733,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13220,19 +19767,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13241,26 +19800,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13269,26 +19833,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13297,28 +19866,36 @@
     "description": "A code security configuration was applied to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13326,27 +19903,35 @@
     "description": "A code security configuration failed to attach to the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13354,28 +19939,36 @@
     "description": "A code security configuration was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13383,28 +19976,36 @@
     "description": "A code security configuration was removed due to a change in repository or enterprise settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13412,29 +20013,37 @@
     "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -13443,29 +20052,37 @@
     "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -13474,19 +20091,32 @@
     "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
-      "operation_type",
-      "request_id",
-      "repo_id",
       "@timestamp",
-      "user_agent",
-      "alert_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "alert_id",
+      "created_at",
+      "alert_number"
     ],
     "docs_reference_titles": "About Dependabot alerts"
   },
@@ -13495,23 +20125,32 @@
     "description": "A Dependabot alert was manually dismissed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "alert_id",
-      "actor",
-      "repo",
       "created_at",
-      "org",
-      "_document_id",
-      "action",
-      "actor_id",
       "dismiss_reason",
-      "user",
       "dismiss_comment",
       "alert_number",
       "actor_is_bot"
@@ -13522,21 +20161,33 @@
     "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "public_repo",
       "owner",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "token_scopes",
       "alert_number"
     ]
   },
@@ -13545,26 +20196,34 @@
     "description": "A Dependabot alert was manually reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo",
-      "alert_number",
-      "request_access_security_header"
+      "alert_number"
     ]
   },
   {
@@ -13572,21 +20231,32 @@
     "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "alert_id",
-      "repo",
-      "operation_type",
-      "action",
-      "repo_id",
-      "_document_id",
-      "user_agent",
-      "request_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "operation_type",
+      "created_at",
+      "alert_number"
     ]
   },
   {
@@ -13594,21 +20264,35 @@
     "description": "A Dependabot alert was withdrawn.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
       "created_at",
       "active",
-      "action",
-      "repository_id",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type"
     ]
   },
@@ -13617,20 +20301,30 @@
     "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
     "fields": [
-      "org",
+      "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
-      "operation_type",
-      "created_at",
-      "actor",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
   },
@@ -13639,24 +20333,31 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13664,26 +20365,32 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13691,23 +20398,30 @@
     "description": "Dependabot alerts was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "request_id",
-      "repo_id",
-      "action",
-      "actor_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "_document_id",
       "user_id",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13715,23 +20429,30 @@
     "description": "Dependabot alerts was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_agent",
-      "created_at",
       "@timestamp",
-      "repo_id",
+      "_document_id",
       "action",
-      "user",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor_id",
-      "_document_id",
-      "user_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -13740,18 +20461,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -13760,19 +20494,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -13781,14 +20527,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -13802,22 +20562,32 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
@@ -13826,28 +20596,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -13855,25 +20634,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13881,14 +20667,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -13905,19 +20705,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13926,19 +20737,30 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13947,20 +20769,30 @@
     "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13969,19 +20801,30 @@
     "description": "Secret scanning was enabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13990,14 +20833,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -14015,25 +20872,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14042,25 +20907,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -14070,25 +20943,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -14097,10 +20978,28 @@
     "description": "A security configuration was created",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -14115,15 +21014,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14141,22 +21033,33 @@
     "description": "A default security configuration setting for new repositories was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14165,22 +21068,33 @@
     "description": "A default security configuration setting for new repositories was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14189,15 +21103,33 @@
     "description": "A security configuration was deleted",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "security_configuration_id",
-      "security_configuration_name",
-      "security_configuration_description",
-      "security_configuration_created_at",
-      "security_configuration_updated_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "security_configuration_id",
+      "security_configuration_name",
+      "security_configuration_description",
+      "security_configuration_created_at",
+      "security_configuration_updated_at",
       "security_configuration_enable_ghas",
       "security_configuration_private_vulnerability_reporting",
       "security_configuration_dependency_graph",
@@ -14207,15 +21139,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14232,15 +21157,30 @@
     "description": "A security configuration policy was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enforcement",
       "security_configuration_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14250,10 +21190,28 @@
     "description": "A security configuration was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -14268,15 +21226,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14294,18 +21245,30 @@
     "description": "A security key was registered for an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14313,18 +21276,30 @@
     "description": "A security key was removed from an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14332,16 +21307,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14351,18 +21339,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -14371,16 +21372,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14391,15 +21405,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -14409,15 +21436,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -14426,17 +21468,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -14445,17 +21500,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -14464,16 +21533,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -14483,14 +21565,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -14500,17 +21597,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -14519,17 +21629,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -14538,18 +21661,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14558,15 +21694,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -14576,16 +21726,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14593,15 +21756,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -14612,16 +21788,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -14631,17 +21820,30 @@
     "description": "Triggered when you send an email update to your sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
     "fields": [
-      "request_id",
-      "actor",
-      "action",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
   },
@@ -14650,17 +21852,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -14671,17 +21886,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -14692,18 +21920,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14713,16 +21952,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14732,17 +21984,30 @@
     "description": "You join the waitlist to join GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "actor_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -14751,16 +22016,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14772,17 +22050,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -14791,19 +22082,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -14812,21 +22116,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "user",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
       "action",
-      "user_id",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "actor_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -14835,19 +22148,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -14856,20 +22180,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14877,18 +22215,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -14896,16 +22249,31 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "domain_name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14913,23 +22281,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14937,23 +22315,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14961,23 +22349,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14985,23 +22383,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15009,15 +22417,30 @@
     "description": "Triggered when you accept a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -15026,15 +22449,30 @@
     "description": "Triggered when you cancel a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -15043,15 +22481,30 @@
     "description": "Triggered when you create a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -15060,15 +22513,30 @@
     "description": "Triggered when you decline a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -15077,15 +22545,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15093,15 +22576,30 @@
     "description": "Triggered when you revoke a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -15110,21 +22608,31 @@
     "description": "A member of an organization was added to a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
-      "user",
       "@timestamp",
-      "actor_id",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "org",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -15134,22 +22642,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -15158,20 +22675,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -15180,42 +22708,66 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
-      "team",
-      "created_at",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
-      "team_type"
-    ],
-    "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
+      "team_type"
+    ],
+    "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
+  },
   {
     "action": "team.create",
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -15224,21 +22776,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -15247,19 +22809,31 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "team",
       "org_id",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
       "operation_type",
-      "_document_id",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -15268,19 +22842,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
       "business",
-      "action",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15288,19 +22873,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "request_id",
       "actor",
-      "org",
-      "created_at",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15308,18 +22904,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
       "@timestamp",
-      "action",
       "_document_id",
-      "user_agent",
-      "user_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -15328,22 +22935,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -15352,22 +22968,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -15377,43 +23002,64 @@
     "description": "A repository was removed from a team's control.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
-      "user_agent",
-      "created_at",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "team.rename",
-    "description": "A team's name was changed.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "name",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "operation_type",
-      "actor_id",
-      "org",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "team.rename",
+    "description": "A team's name was changed.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -15422,17 +23068,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -15441,19 +23100,30 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -15462,28 +23132,37 @@
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
       "operation_type",
       "created_at",
-      "user_agent",
       "permission",
       "new_repo_permission",
       "new_repo_base_role",
       "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_repo_base_role"
     ]
   },
   {
@@ -15491,17 +23170,30 @@
     "description": "A new trusted device was added.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15509,17 +23201,30 @@
     "description": "A trusted device was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15527,14 +23232,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "action",
-      "request_id",
-      "user_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -15543,15 +23263,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "created_at",
-      "user_id",
-      "operation_type",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15559,13 +23294,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "created_at",
-      "user_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15573,17 +23325,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "operation_type",
-      "action",
-      "_document_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15591,17 +23356,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15609,16 +23387,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15626,15 +23418,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "user",
       "_document_id",
-      "request_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15642,18 +23449,30 @@
     "description": "A secondary authentication factor was added to a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -15662,18 +23481,30 @@
     "description": "Two-factor authentication was disabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
     "fields": [
-      "actor",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_id",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Disabling two-factor authentication for your personal account"
   },
@@ -15682,18 +23513,30 @@
     "description": "Two-factor authentication was enabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
-      "actor",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Configuring two-factor authentication"
   },
@@ -15702,15 +23545,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user",
-      "user_id",
-      "action",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "user_agent"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15718,16 +23576,29 @@
     "description": "Two factor recovery codes were regenerated for a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
+      "operation_type",
       "created_at"
     ]
   },
@@ -15736,18 +23607,30 @@
     "description": "A secondary authentication factor was removed from a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -15756,15 +23639,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "operation_type",
-      "user_id",
-      "user",
-      "user_agent",
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15773,16 +23671,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "operation_type",
       "user_agent",
-      "action",
-      "request_id",
-      "actor",
-      "actor_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15790,19 +23701,31 @@
     "description": "An email address was added to a user account.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "actor_id",
-      "actor",
       "email",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding an email address to your GitHub account"
   },
@@ -15811,18 +23734,30 @@
     "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "created_at",
-      "user",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15830,15 +23765,28 @@
     "description": "Audit log entries were exported.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "action",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ]
@@ -15848,20 +23796,31 @@
     "description": "A user was blocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_id",
-      "_document_id",
       "actor_id",
-      "@timestamp",
-      "user_agent",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -15869,18 +23828,30 @@
     "description": "A user changed their password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "actor_id",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15888,18 +23859,30 @@
     "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -15908,17 +23891,30 @@
     "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -15927,16 +23923,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
-      "user",
       "action",
-      "operation_type",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15944,16 +23954,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "_document_id",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15961,16 +23985,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user_id",
       "@timestamp",
-      "user",
+      "_document_id",
       "action",
-      "request_access_security_header"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15978,19 +24016,31 @@
     "description": "A new user account was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "email",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "created_at",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "programmatic_access_type"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "email",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15998,21 +24048,33 @@
     "description": "A user secret for Codespaces was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -16020,20 +24082,31 @@
     "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "oauth_application_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "@timestamp",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -16041,18 +24114,30 @@
     "description": "A user account was destroyed by an asynchronous job.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16061,19 +24146,30 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "oauth_application_id",
+      "_document_id",
       "action",
-      "user",
-      "created_at",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16081,18 +24177,30 @@
     "description": "A user deleted his or her account, triggering user.async_delete.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
-      "created_at",
-      "user_agent",
       "user_id",
-      "operation_type",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16100,18 +24208,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "user_agent",
       "user_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16119,18 +24239,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "actor_id",
+      "_document_id",
       "action",
-      "request_access_security_header"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16139,17 +24271,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "request_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16157,17 +24301,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16175,17 +24332,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16193,17 +24363,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16211,21 +24394,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16233,21 +24426,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -16256,17 +24459,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16274,17 +24490,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16292,17 +24521,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16310,35 +24552,60 @@
     "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "org_id",
-      "actor",
-      "actor_id",
-      "user_agent"
-    ]
-  },
-  {
-    "action": "user.flag_as_large_scale_contributor",
-    "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.",
-    "docs_reference_links": "N/A",
-    "fields": [
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "user.flag_as_large_scale_contributor",
+    "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ]
   },
@@ -16347,17 +24614,31 @@
     "description": "A user requested a password reset.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
     "fields": [
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "email",
-      "created_at",
-      "user_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
   },
@@ -16366,17 +24647,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "created_at",
-      "user_agent",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "request_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16384,18 +24678,30 @@
     "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -16404,19 +24710,31 @@
     "description": "A user signed in.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "actor_id",
       "@timestamp",
-      "user",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "actor",
-      "passkey_nickname",
-      "request_access_security_header"
+      "passkey_nickname"
     ]
   },
   {
@@ -16424,18 +24742,30 @@
     "description": "A user signed out.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -16443,19 +24773,30 @@
     "description": "A comment made by a user was minimized.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
-      "actor_id",
       "@timestamp",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "user",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16463,18 +24804,30 @@
     "description": "A user signed in from a new device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16482,14 +24835,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16497,21 +24866,31 @@
     "description": "An ordinary user account was promoted to a site administrator.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
+      "user_id",
       "user_agent",
+      "created_at",
       "oauth_application_id",
-      "request_id",
-      "operation_type",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -16519,16 +24898,29 @@
     "description": "A user's account was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user",
-      "action",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "operation_type"
     ]
   },
@@ -16537,20 +24929,31 @@
     "description": "An email address was removed from a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "actor_id",
       "created_at",
-      "email",
-      "token_scopes",
-      "programmatic_access_type"
+      "email"
     ]
   },
   {
@@ -16558,20 +24961,32 @@
     "description": "A user secret for Codespaces was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "key",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -16579,17 +24994,30 @@
     "description": "A user account was no longer flagged as a large scale contributor.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16597,20 +25025,31 @@
     "description": "A username was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "request_id",
-      "actor_id",
-      "old_login",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_login",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16618,17 +25057,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "user_agent",
-      "request_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -16637,18 +25088,30 @@
     "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "action",
       "created_at",
-      "actor",
-      "operation_type",
-      "actor_id",
-      "user_id",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam"
   },
@@ -16657,18 +25120,30 @@
     "description": "A user reset their account password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -16676,16 +25151,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -16696,36 +25184,60 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user_id",
       "action",
       "actor",
-      "user",
-      "operation_type",
-      "user_agent",
       "actor_id",
-      "created_at",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "Manage visibility settings for private contributions"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Manage visibility settings for private contributions"
   },
   {
     "action": "user.sign_in_from_unrecognized_device",
     "description": "A user signed in from an unrecognized device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor",
-      "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -16733,18 +25245,30 @@
     "description": "A user signed in from an unrecognized device and location.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "created_at",
-      "_document_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -16752,18 +25276,30 @@
     "description": "A user signed in from an unrecognized location.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "action",
-      "operation_type",
-      "user_agent",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
       "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16771,22 +25307,33 @@
     "description": "Triggered when you clear the status on your profile.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "message",
-      "user",
-      "actor_id",
       "created_at",
-      "request_id",
       "limited_availability",
-      "action",
       "emoji",
-      "operation_type",
-      "user_agent",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -16794,23 +25341,33 @@
     "description": "Triggered when you set or change the status on your profile.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
     "fields": [
-      "limited_availability",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "message",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "limited_availability",
+      "message",
+      "created_at",
       "emoji",
-      "org",
-      "actor",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
   },
@@ -16819,21 +25376,31 @@
     "description": "A user account was suspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "user_agent",
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "token_scopes",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16841,18 +25408,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
-      "actor_id",
       "@timestamp",
-      "operation_type",
       "_document_id",
-      "user_agent",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16860,18 +25439,30 @@
     "description": "A 2FA challenge issued for a user account failed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "actor_id",
-      "actor",
-      "user_id",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16881,16 +25472,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
       "user_agent",
-      "request_id",
-      "action",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16898,18 +25501,30 @@
     "description": "A user used their 2FA recovery codes.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16917,18 +25532,30 @@
     "description": "A user downloaded 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16936,17 +25563,30 @@
     "description": "A user printed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16954,18 +25594,30 @@
     "description": "A user viewed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_agent",
-      "actor",
-      "user_id",
-      "action",
-      "created_at",
-      "user",
-      "operation_type",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "request_access_security_header"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16973,17 +25625,30 @@
     "description": "A user was prompted for a two-factor authentication code.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
     "fields": [
-      "user",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "actor"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
   },
@@ -16992,19 +25657,31 @@
     "description": "A user was unblocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "user_agent",
-      "user_id",
-      "user",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -17013,15 +25690,28 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user_agent",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "request_id",
-      "actor",
-      "action",
       "created_at"
     ]
   },
@@ -17030,21 +25720,31 @@
     "description": "A user account was unsuspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "user_agent",
       "actor",
-      "oauth_application_id",
-      "operation_type",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "user_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17052,21 +25752,33 @@
     "description": "A user secret for Codespaces was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17074,18 +25786,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17093,16 +25817,30 @@
     "description": "A Dependabot rule was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17112,16 +25850,30 @@
     "description": "A Dependabot rule was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17131,18 +25883,31 @@
     "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17152,21 +25917,33 @@
     "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17174,21 +25951,32 @@
     "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -17196,21 +25984,32 @@
     "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -17218,16 +26017,30 @@
     "description": "A Dependabot rule's conditions, actions, or metadata changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17237,27 +26050,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -17266,23 +26085,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17290,10 +26119,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17304,20 +26151,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -17326,23 +26162,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17352,10 +26196,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17367,19 +26229,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -17390,10 +26242,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17402,21 +26272,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -17426,23 +26285,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -17451,22 +26322,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -17474,21 +26356,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -17496,25 +26389,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -17522,23 +26423,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -17552,24 +26466,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -17578,10 +26501,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17591,21 +26532,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -17615,25 +26546,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.16/organization.json b/src/audit-logs/data/ghes-3.16/organization.json
index efae4d3be3c2..7c945881903c 100644
--- a/src/audit-logs/data/ghes-3.16/organization.json
+++ b/src/audit-logs/data/ghes-3.16/organization.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,29 +67,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -72,21 +103,32 @@
     "description": "Credit was accepted for a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Editing a repository security advisory"
   },
@@ -95,21 +137,32 @@
     "description": "Someone was added to the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -117,21 +170,32 @@
     "description": "Credit was declined for a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -140,21 +204,32 @@
     "description": "Someone was removed from the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -163,18 +238,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -182,17 +269,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -203,39 +301,62 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
+  },
   {
     "action": "billing.change_billing_type",
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -244,19 +365,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -265,18 +398,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -284,18 +430,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -303,20 +461,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -325,20 +494,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -349,17 +529,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -367,15 +559,31 @@
     "description": "Existing code scanning alerts appeared in a branch.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -385,15 +593,31 @@
     "description": "Code scanning alerts were fixed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -403,15 +627,29 @@
     "description": "Code scanning alerts were manually dismissed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers",
       "dismissal_approver_id"
     ],
@@ -422,13 +660,31 @@
     "description": "Code scanning alerts were seen for the first time.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -438,15 +694,31 @@
     "description": "Code scanning alerts that were previously fixed reappeared.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -456,15 +728,29 @@
     "description": "Code scanning alerts that were previously dismissed were reopened.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -474,14 +760,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -491,28 +792,34 @@
     "description": "An attempt to create a codespace from a prebuild was made.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "owner",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "user_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
       "created_at",
       "operation_type",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -520,17 +827,30 @@
     "description": "Enterprise setting for Codespaces ownership was updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enablement",
       "organization_names",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -541,25 +861,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -570,22 +899,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -597,22 +937,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "repository_id",
-      "repository",
-      "pull_request_id",
-      "owner",
-      "name",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
+      "owner",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -621,15 +972,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -640,15 +1006,28 @@
     "description": "Policies were applied to codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -658,20 +1037,30 @@
     "description": "Policies were removed from codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -679,19 +1068,30 @@
     "description": "Policies were updated for codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -699,17 +1099,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -719,27 +1132,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "org",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -747,19 +1169,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -767,18 +1202,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -787,42 +1234,61 @@
     "description": "A commit comment was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "created_at",
-      "@timestamp",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "programmatic_access_type"
-    ]
+      "created_at",
+      "operation_type"
+    ]
   },
   {
     "action": "commit_comment.update",
     "description": "A commit comment was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_id",
-      "action",
-      "@timestamp",
-      "repo",
       "org_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -830,21 +1296,33 @@
     "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "reason",
       "plan",
-      "org_id",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -852,13 +1330,28 @@
     "description": "Copilot feature settings were changed at the organization level.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -868,23 +1361,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -892,16 +1392,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -910,24 +1424,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -935,15 +1455,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -953,20 +1486,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -974,19 +1517,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -994,43 +1549,64 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id"
-    ]
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
   {
     "action": "copilot.cfb_seat_management_changed",
     "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_value",
       "new_value",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1038,21 +1614,32 @@
     "description": "The excluded paths for GitHub Copilot were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "excluded_paths",
       "owner_type",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1060,21 +1647,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1082,21 +1679,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1104,21 +1711,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1126,17 +1743,30 @@
     "description": "The plan for GitHub Copilot was updated.",
     "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_plan",
       "plan",
-      "business_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1148,20 +1778,31 @@
     "description": "The plan for GitHub Copilot was scheduled to be downgraded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "current_plan",
       "scheduled_plan"
@@ -1172,21 +1813,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1196,43 +1846,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type"
-    ]
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
   },
   {
     "action": "custom_hosted_runner.update",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1242,18 +1910,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1266,18 +1947,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1291,14 +1985,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -1311,8 +2020,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1321,27 +2029,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1350,19 +2066,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1371,16 +2099,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "definition_id"
@@ -1392,19 +2133,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1413,19 +2165,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1434,19 +2197,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1455,19 +2229,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1476,17 +2261,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1494,19 +2292,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1515,19 +2324,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1535,19 +2355,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1556,19 +2387,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1576,19 +2418,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1597,19 +2450,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1617,20 +2481,31 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
-    ],
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
   {
@@ -1638,20 +2513,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1659,21 +2544,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "repo_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "org_id",
-      "_document_id",
       "actor_id",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1681,20 +2575,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "request_id",
-      "org",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1702,22 +2606,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "actor_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "title",
-      "_document_id",
-      "created_at",
-      "repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -1725,21 +2638,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "team",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "number",
-      "org",
-      "title",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id"
+      "team",
+      "created_at",
+      "number",
+      "title",
+      "operation_type"
     ]
   },
   {
@@ -1747,18 +2672,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user_id",
-      "actor",
       "number",
-      "user",
-      "created_at",
-      "request_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1766,18 +2704,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "_document_id",
-      "request_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "number",
       "team",
       "created_at"
@@ -1788,21 +2737,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "_document_id",
-      "title",
-      "user",
-      "user_agent",
-      "org",
-      "operation_type",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "team",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type",
+      "team",
       "number"
     ]
   },
@@ -1811,17 +2771,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "owner",
-      "owner_type",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
+      "owner_type",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -1832,16 +2806,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -1852,18 +2840,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
       "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -1874,17 +2876,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was created.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "org_id",
       "action",
-      "request_id",
-      "org",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -1893,17 +2908,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "actor_id",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -1912,22 +2940,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1936,22 +2973,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1959,28 +3006,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1989,27 +3042,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2018,25 +3079,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2045,26 +3114,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2073,21 +3149,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2096,22 +3184,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2120,25 +3218,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2147,22 +3254,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2171,21 +3290,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -2196,19 +3325,30 @@
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2217,20 +3357,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2239,19 +3389,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "user",
-      "user_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2260,23 +3421,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2284,18 +3454,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2306,20 +3486,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2329,25 +3519,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -2355,25 +3555,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -2381,26 +3590,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -2409,25 +3627,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -2435,26 +3662,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -2462,21 +3698,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -2485,19 +3732,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -2505,21 +3765,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -2528,19 +3799,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -2551,20 +3836,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2574,24 +3871,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2602,23 +3910,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2629,21 +3949,33 @@
     "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
       "operation_type",
-      "@timestamp",
       "integration",
-      "action",
-      "user_agent",
       "reason",
-      "_document_id",
-      "org",
-      "org_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -2654,20 +3986,32 @@
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
       "@timestamp",
-      "actor_id",
-      "org",
       "_document_id",
-      "requester",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "requester",
       "created_at",
       "url",
-      "org_id",
-      "request_id",
       "operation_type",
-      "actor",
       "integration",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -2677,20 +4021,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
-      "request_id",
-      "name",
-      "repository_selection",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "repository_selection",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2700,19 +4057,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -2721,20 +4092,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -2744,20 +4128,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -2766,20 +4163,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -2788,20 +4198,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2809,19 +4231,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2830,19 +4265,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2851,17 +4299,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2874,21 +4335,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
-      "user_id",
-      "name",
-      "transfer_to_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "transfer_to_id",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -2902,17 +4376,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2924,19 +4411,30 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "user"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2944,19 +4442,30 @@
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2964,20 +4473,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "user_id",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
-      "_document_id",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "actor_id",
       "operation_type",
-      "org",
       "created_at"
     ]
   },
@@ -2986,19 +4504,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3006,24 +4535,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3031,24 +4568,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "ip_allow_list_entry",
-      "org",
-      "operation_type",
-      "created_at",
-      "active",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at",
+      "active"
     ]
   },
   {
@@ -3056,19 +4601,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "actor_id",
       "ip_allow_list_entry",
-      "active",
-      "org_id",
-      "@timestamp"
+      "active"
     ]
   },
   {
@@ -3076,22 +4634,31 @@
     "description": "A comment on an issue was deleted from the repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "org",
-      "repo",
-      "actor_id",
       "@timestamp",
-      "created_at",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "oauth_application_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -3099,24 +4666,30 @@
     "description": "A comment on an issue was pinned to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3127,19 +4700,29 @@
     "description": "A comment on an issue was unpinned from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3150,22 +4733,31 @@
     "description": "A comment on an issue (other than the initial one) changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "action",
-      "repo_id",
-      "org_id",
-      "created_at",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "request_id",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
-      "oauth_application_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -3173,21 +4765,31 @@
     "description": "An issue was deleted from the repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue",
     "fields": [
-      "user",
-      "actor_id",
-      "created_at",
-      "title",
       "@timestamp",
       "_document_id",
-      "request_id",
-      "actor",
-      "user_id",
       "action",
-      "operation_type",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type"
     ],
     "docs_reference_titles": "Deleting an issue"
   },
@@ -3196,23 +4798,33 @@
     "description": "An issue was pinned to a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
       "action",
       "actor",
-      "operation_type",
-      "owner_type",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "number",
-      "repo",
-      "event",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "owner_type",
+      "number",
+      "event"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3221,22 +4833,32 @@
     "description": "An issue was transferred to another repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "owner_type",
-      "actor_id",
       "number",
-      "repo",
       "operation_type",
-      "_document_id",
-      "repo_id",
-      "action",
-      "request_id",
-      "created_at",
-      "actor",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Transferring an issue to another repository"
   },
@@ -3245,24 +4867,33 @@
     "description": "An issue was unpinned from a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
-      "event",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
-      "action",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "operation_type",
-      "_document_id",
-      "number",
-      "owner_type",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "token_scopes",
-      "request_access_security_header"
+      "user_agent",
+      "event",
+      "created_at",
+      "operation_type",
+      "number",
+      "owner_type"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3271,61 +4902,94 @@
     "description": "The ability for enterprise members to delete issues was disabled  Members cannot delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
-      "operation_type",
-      "request_id",
-      "actor_id",
-      "user_id",
-      "created_at",
       "_document_id",
+      "action",
       "actor",
-      "user",
-      "org",
-      "org_id"
-    ],
-    "docs_reference_titles": "Enforcing repository management policies in your enterprise"
-  },
-  {
-    "action": "issues.deletes_enabled",
-    "description": "The ability for enterprise members to delete issues was enabled  Members can delete issues in any organizations in an enterprise.",
-    "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
-    "fields": [
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "request_id",
-      "actor",
-      "@timestamp",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
   {
-    "action": "issues.deletes_policy_cleared",
-    "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
+    "action": "issues.deletes_enabled",
+    "description": "The ability for enterprise members to delete issues was enabled  Members can delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
       "business_id",
-      "action",
-      "operation_type",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "Enforcing repository management policies in your enterprise"
+  },
+  {
+    "action": "issues.deletes_policy_cleared",
+    "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
+    "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
+    "fields": [
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3334,18 +4998,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3353,21 +5029,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -3375,21 +5064,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3397,22 +5099,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -3420,19 +5135,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -3442,22 +5170,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -3465,22 +5206,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "primary_category",
-      "secondary_category",
-      "marketplace_listing",
-      "oauth_application",
-      "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "secondary_category",
+      "marketplace_listing",
+      "oauth_application",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3488,20 +5242,30 @@
     "description": "The ability for members to publish GitHub Pages sites was disabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3510,20 +5274,30 @@
     "description": "The ability for members to publish GitHub Pages sites was enabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3532,21 +5306,30 @@
     "description": "The ability for members to publish private GitHub Pages was disabled  Members cannot publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3555,22 +5338,30 @@
     "description": "The ability for members to publish private GitHub Pages was enabled  Members can publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3579,21 +5370,30 @@
     "description": "The ability for members to publish public GitHub Pages was disabled  Members cannot publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3602,22 +5402,30 @@
     "description": "The ability for members to publish public GitHub Pages was enabled  Members can publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3626,19 +5434,30 @@
     "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "operation_type",
       "user_agent",
-      "actor",
-      "actor_id",
-      "business_id",
-      "@timestamp",
-      "created_at",
-      "action"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3647,18 +5466,29 @@
     "description": "The ability for enterprise members to delete repositories was disabled  Members cannot delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "request_id",
-      "org",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "actor",
       "operation_type",
-      "org_id",
-      "action",
-      "@timestamp",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -3668,22 +5498,31 @@
     "description": "The ability for enterprise members to delete repositories was enabled  Members can delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "action",
-      "org_id",
-      "user_id",
-      "business",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user",
-      "business_id",
-      "created_at",
+      "action",
       "actor",
-      "org",
-      "operation_type",
-      "user_agent"
-    ],
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
   {
@@ -3693,16 +5532,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -3711,21 +5561,30 @@
     "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "created_at",
-      "user_id",
       "business_id",
-      "user",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "org_id",
-      "@timestamp"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -3734,19 +5593,30 @@
     "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "user_id",
-      "business",
-      "business_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "actor_id"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -3755,19 +5625,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3775,21 +5657,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3799,16 +5690,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3818,18 +5722,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3839,77 +5756,124 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
-      "operation_type",
-      "created_at",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "metered_billing_configuration.destroy",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
-    "action": "metered_billing_configuration.update",
+    "action": "metered_billing_configuration.destroy",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "org",
-      "created_at",
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "migration.create",
-    "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "metered_billing_configuration.update",
+    "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "migration.create",
+    "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "user_agent",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -3917,16 +5881,30 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "org_id",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3934,24 +5912,32 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
-      "repo_id",
       "operation_type",
-      "@timestamp",
-      "user_agent",
       "created_at",
-      "org",
-      "action",
-      "_document_id",
-      "repo",
-      "actor",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3959,15 +5945,28 @@
     "description": "A network configuration for a hosted compute service was created.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -3985,15 +5984,28 @@
     "description": "A network configuration for a hosted compute service was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4006,15 +6018,28 @@
     "description": "A network configuration for a hosted compute service was updated.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4031,20 +6056,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4053,42 +6090,66 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "request_id",
-      "action",
-      "user",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
-  },
-  {
-    "action": "oauth_application.generate_client_secret",
-    "description": "An OAuth application's secret key was generated.",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
+    ],
+    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+  },
+  {
+    "action": "oauth_application.generate_client_secret",
+    "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4097,20 +6158,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4119,19 +6192,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4140,20 +6226,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4162,20 +6260,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4184,19 +6294,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4205,17 +6328,28 @@
     "description": "An invitation sent to an organization to join an enterprise was accepted.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4226,20 +6360,30 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
   },
@@ -4248,21 +6392,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
-      "org",
-      "operation_type",
-      "request_id",
+      "action",
       "actor",
-      "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
-      "user_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -4271,24 +6425,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4296,21 +6460,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -4318,20 +6492,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4339,22 +6523,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4362,20 +6554,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4383,22 +6585,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4406,19 +6616,30 @@
     "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4427,19 +6648,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -4449,17 +6681,30 @@
     "description": "Third-party application access for outside collaborators was disabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Limiting OAuth app and GitHub App access requests and installations"
   },
@@ -4468,15 +6713,28 @@
     "description": "Third-party application access for outside collaborators was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4487,15 +6745,28 @@
     "description": "The organization was archived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4505,17 +6776,30 @@
     "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
   },
@@ -4524,21 +6808,32 @@
     "description": "An export of the organization's Git events was created.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "start",
       "end",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization"
   },
@@ -4547,16 +6842,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -4565,18 +6873,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
-      "actor",
-      "user_agent",
-      "org_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "blocked_user",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -4585,19 +6906,30 @@
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -4607,22 +6939,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "email",
-      "@timestamp",
-      "actor",
-      "action",
       "operation_type",
-      "user_agent",
-      "org",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -4630,19 +6973,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -4650,23 +7004,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4674,21 +7036,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4696,23 +7068,31 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4720,23 +7100,31 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4744,21 +7132,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -4767,21 +7164,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -4790,20 +7196,31 @@
     "description": "Access to use Codespaces on internal and private repositories was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "enablement",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "enablement",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization"
   },
@@ -4812,21 +7229,31 @@
     "description": "Ownership and payment for codespaces was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "owner_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
   },
@@ -4835,16 +7262,29 @@
     "description": "A team has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4854,16 +7294,29 @@
     "description": "A team has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4873,19 +7326,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -4894,17 +7358,30 @@
     "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -4913,21 +7390,30 @@
     "description": "A user has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -4935,21 +7421,30 @@
     "description": "A user has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -4957,16 +7452,29 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
@@ -4976,17 +7484,30 @@
     "description": "The interaction limit for prior contributors only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -4995,17 +7516,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5015,16 +7549,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5033,17 +7580,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5052,17 +7612,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5071,22 +7644,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -5095,17 +7676,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5116,15 +7708,28 @@
     "description": "Server statistics were exported for the organization.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5135,18 +7740,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
-      "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -5155,20 +7772,31 @@
     "description": "A GitHub Actions secret was created for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5177,20 +7805,32 @@
     "description": "A GitHub Actions variable was created for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5199,21 +7839,33 @@
     "description": "A Codespaces or Dependabot secret was created for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5221,21 +7873,30 @@
     "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "org_id",
-      "business",
-      "action",
       "@timestamp",
-      "org",
       "_document_id",
-      "business_id",
+      "action",
       "actor",
-      "token_scopes",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "actor_is_bot",
       "oauth_credential_type",
       "managed_oauth_access_id",
@@ -5251,24 +7912,32 @@
     "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
-      "created_at",
-      "org_id",
-      "business_id",
-      "operation_type",
-      "request_id",
       "_document_id",
       "action",
+      "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "token_scopes",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot",
       "oauth_credential_type",
-      "request_access_security_header",
       "managed_oauth_access_id",
       "managed_token_id",
       "managed_oauth_scopes",
@@ -5282,21 +7951,32 @@
     "description": "An owner revoked authorized credentials.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "oauth_application_id",
-      "org_id",
       "operation_type",
-      "action",
-      "business",
-      "request_id",
       "created_at",
-      "business_id",
-      "actor_id",
-      "_document_id",
-      "user_agent",
       "oauth_credential_type",
       "managed_oauth_access_id",
       "managed_token_id",
@@ -5311,18 +7991,30 @@
     "description": "An organization was deleted by a user or staff.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "org_id",
-      "org",
       "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5330,20 +8022,30 @@
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -5352,16 +8054,29 @@
     "description": "Third-party application access restrictions for an organization were disabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization"
@@ -5371,19 +8086,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -5392,14 +8118,31 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sso_url",
       "issuer",
-      "action",
-      "@timestamp",
-      "_document_id",
       "created_at",
-      "org",
       "operation_type"
     ]
   },
@@ -5408,21 +8151,30 @@
     "description": "Display of IP addresses within audit log events for the organization was disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -5431,17 +8183,30 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5449,19 +8214,30 @@
     "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5469,19 +8245,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
-      "action",
-      "actor_id",
-      "org_id"
+      "created_at"
     ]
   },
   {
@@ -5489,38 +8276,62 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
-      "actor_id",
-      "org",
-      "request_id",
       "action",
-      "@timestamp"
-    ],
-    "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
-  },
-  {
-    "action": "org.enable_oauth_app_restrictions",
-    "description": "Third-party application access restrictions for an organization were enabled.",
-    "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization",
-    "fields": [
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
+  },
+  {
+    "action": "org.enable_oauth_app_restrictions",
+    "description": "Third-party application access restrictions for an organization were enabled.",
+    "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization"
   },
@@ -5529,19 +8340,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -5550,19 +8372,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "sso_url",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "issuer",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "sso_url",
+      "created_at",
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -5571,21 +8406,30 @@
     "description": "Display of IP addresses within audit log events for the organization was enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -5594,17 +8438,30 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
   },
@@ -5613,17 +8470,30 @@
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -5632,18 +8502,31 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
-      "org",
-      "user_agent",
-      "request_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "manager",
       "operation_type",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5651,23 +8534,32 @@
     "description": "A new user was invited to join an organization.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
     "fields": [
-      "org",
-      "user_id",
-      "invitation_id",
-      "org_id",
-      "user",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -5676,17 +8568,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5696,19 +8599,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5716,19 +8630,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5736,19 +8661,31 @@
     "description": "Access to an organization was granted for an OAuth App.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "operation_type",
-      "org_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization"
@@ -5758,20 +8695,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -5780,18 +8728,31 @@
     "description": "Access was disabled for an OAuth App that was previously approved.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization",
     "fields": [
-      "request_id",
-      "url",
-      "created_at",
-      "org_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
@@ -5801,19 +8762,31 @@
     "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "url",
-      "org_id",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "url",
       "oauth_application_name"
     ]
   },
@@ -5822,20 +8795,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -5845,16 +8829,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5862,20 +8859,31 @@
     "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "reason",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "reason",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -5884,20 +8892,30 @@
     "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "request_access_security_header"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -5906,19 +8924,30 @@
     "description": "An organization owner downloaded the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -5927,19 +8956,30 @@
     "description": "An organization owner generated the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -5948,19 +8988,30 @@
     "description": "An organization owner printed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -5969,19 +9020,30 @@
     "description": "An organization owner viewed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -5990,19 +9052,31 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -6011,20 +9085,31 @@
     "description": "A GitHub Actions secret was removed from an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -6033,21 +9118,31 @@
     "description": "A GitHub Actions variable was removed from an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -6056,18 +9151,29 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
@@ -6077,44 +9183,63 @@
     "description": "A Codespaces or Dependabot secret was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "key",
-      "integration",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes"
-    ]
-  },
-  {
-    "action": "org.remove_member",
-    "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
-      "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "org_id",
+      "created_at"
+    ]
+  },
+  {
+    "action": "org.remove_member",
+    "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6122,21 +9247,30 @@
     "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user",
-      "org_id",
-      "created_at",
-      "request_id",
       "@timestamp",
-      "action",
-      "operation_type",
-      "user_agent",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6144,21 +9278,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -6166,18 +9310,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -6186,19 +9342,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
-      "old_login",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_login",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6206,14 +9374,28 @@
     "description": "Triggered when a required workflow is created.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6224,14 +9406,28 @@
     "description": "Triggered when a required workflow is deleted.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6242,14 +9438,28 @@
     "description": "Triggered when a required workflow is updated.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6260,20 +9470,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -6282,18 +9502,29 @@
     "description": "A member's linked identity was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
       "user_id",
-      "@timestamp",
-      "action",
-      "actor_id",
       "user_agent",
-      "_document_id",
-      "request_id",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
@@ -6303,19 +9534,30 @@
     "description": "A member's SAML session was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
-      "actor_id",
-      "created_at",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
   },
@@ -6324,21 +9566,33 @@
     "description": "A self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -6348,21 +9602,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6371,20 +9635,31 @@
     "description": "A self-hosted runner group was renamed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6393,23 +9668,33 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -6418,23 +9703,31 @@
     "description": "A self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6443,19 +9736,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -6464,25 +9770,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6491,21 +9808,32 @@
     "description": "The visibility of a self-hosted runner group was updated via the REST API.",
     "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
   },
@@ -6514,21 +9842,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -6538,21 +9875,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -6562,20 +9908,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6584,22 +9940,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6608,21 +9972,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6631,21 +10004,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6654,22 +10036,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6678,21 +10068,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6701,22 +10100,30 @@
     "description": "Generic secrets have been disabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6724,22 +10131,30 @@
     "description": "Generic secrets have been enabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6747,21 +10162,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -6771,21 +10195,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -6795,19 +10228,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -6817,21 +10261,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -6841,21 +10294,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -6865,19 +10327,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -6887,22 +10360,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6911,22 +10392,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6935,22 +10424,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6959,21 +10456,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -6982,21 +10488,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7005,22 +10520,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7029,22 +10552,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7053,26 +10584,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -7081,26 +10621,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7108,28 +10656,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7137,26 +10693,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7164,15 +10728,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7181,15 +10762,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7198,7 +10796,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -7213,20 +10832,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -7235,16 +10865,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -7255,18 +10898,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -7275,17 +10931,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7293,18 +10962,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -7313,18 +10994,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -7333,18 +11027,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -7353,22 +11059,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issuer",
-      "business",
       "operation_type",
       "created_at",
-      "request_id",
-      "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7376,21 +11092,32 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
   },
@@ -7399,19 +11126,30 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -7422,15 +11160,28 @@
     "description": "The organization was unarchived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7440,19 +11191,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
-      "oauth_application_id",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "blocked_user",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -7461,20 +11225,32 @@
     "description": "A GitHub Actions secret was updated for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "created_at",
       "key",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -7483,23 +11259,34 @@
     "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -7508,20 +11295,32 @@
     "description": "A GitHub Actions variable was updated for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -7530,20 +11329,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -7551,22 +11362,33 @@
     "description": "A Codespaces or Dependabot secret was updated for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "visibility",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "visibility",
+      "integration",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7575,20 +11397,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -7596,17 +11429,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -7616,20 +11462,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -7638,17 +11495,30 @@
     "description": "The name of the default branch was changed for new repositories in the organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
   },
@@ -7657,17 +11527,30 @@
     "description": "The repository self-hosted runners policy was updated",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_repo_runners_policy",
       "new_repo_runners_policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -7678,19 +11561,32 @@
     "description": "An organization's SAML provider settings were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "issuer",
-      "org",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -7698,18 +11594,30 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "org",
-      "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
@@ -7718,18 +11626,30 @@
     "description": "A default label was created for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
-      "_document_id",
-      "action",
-      "created_at",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label"
   },
@@ -7738,17 +11658,30 @@
     "description": "A default label was deleted for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label"
   },
@@ -7757,17 +11690,30 @@
     "description": "A default label was edited for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label",
     "fields": [
-      "org",
-      "created_at",
       "@timestamp",
-      "actor",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label"
   },
@@ -7776,20 +11722,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "org_id",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -7798,16 +11757,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -7816,14 +11790,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -7834,16 +11823,31 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "operation_type",
-      "domain_name",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
       "_document_id",
-      "actor_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "domain_name",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -7852,16 +11856,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -7871,17 +11888,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7891,16 +11919,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -7910,20 +11951,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -7931,40 +11982,62 @@
     "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor",
-      "business_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
       "user_agent",
-      "_document_id",
       "created_at",
-      "operation_type",
-      "request_id",
-      "business"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
   {
     "action": "organization_projects_change.disable",
     "description": "Organization projects were disabled for all organizations in an enterprise.",
-    "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
-    "fields": [
-      "org_id",
-      "action",
-      "user",
-      "org",
-      "created_at",
-      "user_agent",
-      "request_id",
-      "actor_id",
-      "operation_type",
+    "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -7973,18 +12046,29 @@
     "description": "Organization projects were enabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor_id",
-      "org_id",
-      "created_at",
-      "user_id",
-      "org",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
@@ -7994,23 +12078,33 @@
     "description": "An organization role was assigned to a user or team.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About custom organization roles"
   },
@@ -8019,25 +12113,32 @@
     "description": "A custom organization role was created in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8049,25 +12150,32 @@
     "description": "A custom organization role was deleted in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8078,19 +12186,30 @@
     "description": "A user or team was unassigned an organization role.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type"
     ],
@@ -8101,26 +12220,33 @@
     "description": "A custom organization role was edited in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
       "old_role_permissions",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -8133,22 +12259,33 @@
     "description": "An organization's default project base role was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_project_base_role",
-      "new_project_base_role",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_project_base_role",
+      "new_project_base_role",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8156,20 +12293,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -8179,23 +12327,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8204,21 +12363,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -8229,21 +12399,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8252,20 +12435,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8274,17 +12471,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8295,20 +12507,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8317,18 +12543,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8336,16 +12574,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8353,18 +12605,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8372,18 +12636,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8394,22 +12671,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "programmatic_access_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8417,22 +12703,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8440,18 +12735,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8462,18 +12770,28 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8484,18 +12802,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8506,23 +12834,34 @@
     "description": "A personal access token expiration limit was set.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "token_expiration",
       "old_token_expiration",
       "exempt_administrators",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8530,21 +12869,32 @@
     "description": "A personal access token expiration limit was unset.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "programmatic_access_type",
-      "old_token_expiration",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_token_expiration",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8552,17 +12902,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8573,18 +12936,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8596,17 +12972,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8618,20 +13007,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -8643,20 +13041,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -8668,20 +13075,29 @@
     "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -8693,20 +13109,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -8718,15 +13143,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8736,17 +13176,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8756,15 +13207,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8774,19 +13240,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "business_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8794,23 +13271,30 @@
     "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "created_at",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
-      "repo",
       "action",
-      "user_agent",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "request_id",
-      "user_id",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8818,23 +13302,30 @@
     "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "repo",
-      "org",
-      "business",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org_id",
-      "created_at",
-      "business_id"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8842,17 +13333,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8862,17 +13364,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8882,17 +13395,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8902,17 +13426,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8922,17 +13457,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -8942,17 +13490,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8960,25 +13521,36 @@
     "description": "A project's base role was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_project_base_role",
       "new_project_base_role",
       "project_number",
       "public_project",
-      "business",
       "project_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8986,20 +13558,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -9009,25 +13592,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -9035,20 +13630,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9056,25 +13663,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9082,17 +13701,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9100,17 +13732,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9118,18 +13763,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -9138,18 +13795,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -9158,19 +13827,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -9178,17 +13858,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -9200,22 +13893,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -9223,19 +13925,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9243,17 +13956,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
-      "org_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9261,18 +13987,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -9280,20 +14019,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9301,18 +14050,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -9321,18 +14082,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -9341,16 +14114,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -9362,21 +14148,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -9384,22 +14182,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -9408,29 +14216,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9438,24 +14251,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
       "user_agent",
-      "repo",
+      "operation_type",
       "name",
-      "org_id",
-      "user",
-      "_document_id",
-      "request_id",
-      "actor",
-      "actor_id",
-      "org",
-      "action",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -9466,21 +14287,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -9491,22 +14322,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -9514,24 +14355,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "authorized_actors_only",
       "authorized_actors",
       "created_at",
-      "user_agent",
       "name",
-      "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
-      "actor_id",
-      "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -9539,30 +14390,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -9572,28 +14430,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -9604,23 +14470,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -9628,22 +14503,32 @@
     "description": "Branch deletion was enabled or disabled for a protected branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "operation_type",
-      "request_id",
-      "repo",
       "@timestamp",
-      "org_id",
-      "org",
-      "action",
-      "allow_deletions_enforcement_level",
       "_document_id",
-      "created_at",
-      "actor_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_deletions_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -9651,23 +14536,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "actor_id",
-      "name",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo",
-      "operation_type",
-      "request_id",
-      "allow_force_pushes_enforcement_level",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_force_pushes_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -9675,24 +14569,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -9701,22 +14604,32 @@
     "description": "Required linear commit history was enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "operation_type",
       "actor",
-      "linear_history_requirement_enforcement_level",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "linear_history_requirement_enforcement_level",
       "name",
-      "org_id",
-      "repo_id",
-      "org",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -9724,24 +14637,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "lock_allows_fetch_and_merge",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -9750,27 +14672,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -9779,18 +14708,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9801,24 +14743,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -9826,25 +14777,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9852,22 +14810,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -9875,22 +14843,33 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
   },
@@ -9899,22 +14878,32 @@
     "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "required_approving_review_count",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -9922,25 +14911,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
     ]
   },
   {
@@ -9948,22 +14944,32 @@
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
       "action",
       "actor",
       "actor_id",
-      "signature_requirement_enforcement_level",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "programmatic_access_type"
+      "operation_type",
+      "name",
+      "created_at",
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -9971,22 +14977,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "created_at",
-      "repo_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "name",
-      "actor",
-      "repo",
       "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
+      "strict_required_status_checks_policy"
     ]
   },
   {
@@ -9994,23 +15010,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -10019,24 +15046,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -10045,20 +15083,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10067,21 +15119,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -10091,22 +15156,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10115,25 +15192,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10142,23 +15229,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10167,18 +15265,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -10188,21 +15300,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -10211,19 +15334,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -10234,23 +15370,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -10260,17 +15408,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -10278,19 +15440,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -10298,19 +15473,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -10320,21 +15508,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -10343,27 +15542,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "pull_request_url",
       "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10371,23 +15577,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -10396,18 +15614,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -10415,19 +15647,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -10437,20 +15681,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
-      "repo",
-      "created_at",
-      "request_id",
-      "comment_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "comment_id",
+      "operation_type"
     ]
   },
   {
@@ -10458,18 +15713,31 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "_document_id",
-      "@timestamp",
-      "comment_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "comment_id"
     ]
   },
   {
@@ -10477,21 +15745,33 @@
     "description": "A review on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -10499,20 +15779,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -10521,19 +15814,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -10543,22 +15850,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -10567,21 +15884,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -10590,25 +15916,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -10617,23 +15950,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -10642,24 +15983,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -10668,23 +16016,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -10694,43 +16050,65 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "visibility",
+      "visibility"
+    ],
+    "docs_reference_titles": "/repositories/archiving-a-github-repository"
+  },
+  {
+    "action": "repo.change_merge_setting",
+    "description": "Pull request merge options were changed for a repository.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
-    ],
-    "docs_reference_titles": "/repositories/archiving-a-github-repository"
-  },
-  {
-    "action": "repo.change_merge_setting",
-    "description": "Pull request merge options were changed for a repository.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "actor",
-      "oauth_application_id",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
+      "oauth_application_id",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor_id",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -10739,24 +16117,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -10765,24 +16153,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -10790,24 +16186,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -10815,24 +16219,32 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -10840,24 +16252,32 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -10865,23 +16285,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -10892,25 +16321,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -10919,26 +16354,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -10947,25 +16390,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "query_suite",
       "threat_model",
       "languages",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -10975,19 +16427,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to this repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -10996,19 +16459,30 @@
     "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11016,17 +16490,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11035,15 +16522,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -11054,16 +16554,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11073,17 +16586,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11093,19 +16619,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11114,45 +16651,64 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+  },
+  {
+    "action": "repo.configure_self_hosted_jit_runner",
+    "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
+    "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
-  },
-  {
-    "action": "repo.configure_self_hosted_jit_runner",
-    "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
-    "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
-    "fields": [
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "hashed_token",
-      "programmatic_access_type",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
       "token_id",
       "token_scopes",
-      "repo",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -11161,30 +16717,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -11194,20 +16755,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -11216,25 +16788,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -11243,23 +16823,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11267,25 +16858,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -11295,23 +16895,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -11321,23 +16930,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -11345,21 +16964,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11367,21 +16996,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -11389,22 +17028,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -11412,21 +17060,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -11434,20 +17092,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11455,22 +17124,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11478,18 +17156,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11497,22 +17189,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11520,40 +17222,62 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
     "action": "repo.register_self_hosted_runner",
     "description": "A new self-hosted runner was registered.",
-    "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
-    "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
+    "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
+    "fields": [
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -11562,22 +17286,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -11586,24 +17319,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -11612,23 +17353,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11636,26 +17387,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -11664,21 +17420,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -11687,25 +17452,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11713,22 +17484,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -11737,25 +17518,34 @@
     "description": "A branch was renamed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "old_branch",
-      "new_branch",
-      "default_branch",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "old_branch",
+      "new_branch",
+      "default_branch",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch"
@@ -11765,19 +17555,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11785,17 +17586,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -11804,17 +17620,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -11823,7 +17654,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -11838,23 +17690,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -11864,20 +17725,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11888,21 +17760,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -11911,22 +17794,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -11935,21 +17828,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -11958,22 +17862,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -11984,16 +17898,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -12003,22 +17928,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -12027,23 +17963,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12053,19 +17999,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -12073,21 +18029,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -12096,24 +18062,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -12121,25 +18096,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12148,24 +18130,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12174,25 +18166,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12201,22 +18201,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12225,26 +18234,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12252,31 +18269,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12285,22 +18309,30 @@
     "description": "Someone closed a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories",
     "fields": [
-      "actor",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "created_at",
-      "repo_id",
-      "_document_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "About repository security advisories"
   },
@@ -12309,18 +18341,29 @@
     "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "_document_id",
+      "operation_type",
       "created_at"
     ]
   },
@@ -12329,17 +18372,30 @@
     "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -12348,21 +18404,30 @@
     "description": "GitHub withdrew a security advisory that was published in error.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -12370,18 +18435,30 @@
     "description": "Someone opened a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
       "repo_id",
-      "action",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12389,21 +18466,30 @@
     "description": "Someone published a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "repo_id",
       "_document_id",
-      "repo",
-      "business_id",
-      "business",
-      "request_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "org"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12411,17 +18497,30 @@
     "description": "Someone reopened as draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "repo",
-      "action",
-      "created_at",
       "@timestamp",
-      "request_id",
-      "actor_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "public_repo"
     ]
   },
@@ -12430,21 +18529,30 @@
     "description": "Someone edited a draft or published security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "repo_id",
-      "org_id",
       "business",
-      "actor",
-      "user_agent",
-      "created_at",
-      "_document_id",
       "business_id",
-      "repo",
-      "action",
-      "operation_type",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12452,24 +18560,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -12478,24 +18592,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -12504,19 +18624,30 @@
     "description": "Data use settings were disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "repo_id",
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -12525,21 +18656,30 @@
     "description": "Data use settings were enabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "org",
-      "user_id",
-      "repo_id",
       "@timestamp",
-      "request_id",
-      "actor",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org_id",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -12548,23 +18688,30 @@
     "description": "The dependency graph was disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "repo_id",
-      "operation_type",
-      "user_id",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
-      "@timestamp",
-      "org_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -12573,24 +18720,31 @@
     "description": "The dependency graph was enabled for a private repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor_id",
-      "repo_id",
+      "created_at",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12599,21 +18753,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -12621,21 +18785,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12643,21 +18817,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -12665,20 +18850,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -12686,21 +18883,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12708,19 +18916,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -12728,19 +18949,30 @@
     "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise  Organization owners can now control their repository projects settings.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "user_agent",
-      "user",
-      "business_id",
-      "business",
-      "operation_type",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -12749,20 +18981,30 @@
     "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
       "@timestamp",
-      "repo",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "repo_id",
-      "actor",
-      "request_id",
-      "programmatic_access_type"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12771,20 +19013,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
       "created_at",
-      "org_id",
-      "action",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "actor_id",
-      "repo"
+      "operation_type"
     ]
   },
   {
@@ -12792,31 +19043,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -12825,19 +19084,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -12845,8 +19115,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -12855,23 +19124,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -12896,26 +19174,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -12924,26 +19208,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -12952,23 +19242,30 @@
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -12978,23 +19275,30 @@
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13004,24 +19308,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13031,24 +19342,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -13057,24 +19375,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13084,23 +19409,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13110,23 +19442,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13135,22 +19475,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13158,24 +19506,32 @@
     "description": "Generic secrets have been disabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13183,22 +19539,31 @@
     "description": "Generic secrets have been enabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13207,24 +19572,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -13233,24 +19606,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -13259,19 +19640,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13280,24 +19673,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13306,24 +19707,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13332,19 +19741,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13353,26 +19774,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13381,26 +19807,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13409,28 +19840,36 @@
     "description": "A code security configuration was applied to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13438,27 +19877,35 @@
     "description": "A code security configuration failed to attach to the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13466,28 +19913,36 @@
     "description": "A code security configuration was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13495,28 +19950,36 @@
     "description": "A code security configuration was removed due to a change in repository or enterprise settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -13524,20 +19987,30 @@
     "description": "The repository visibility change setting was cleared for an organization or enterprise.",
     "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
       "business",
-      "action",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business_id",
-      "@timestamp",
       "user_agent",
-      "actor",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise"
   },
@@ -13546,20 +20019,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "org_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
-      "user_id",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13567,19 +20050,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "_document_id",
       "@timestamp",
-      "user_agent",
-      "user",
-      "created_at",
-      "org",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13587,29 +20081,37 @@
     "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -13618,29 +20120,37 @@
     "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -13649,19 +20159,32 @@
     "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
-      "operation_type",
-      "request_id",
-      "repo_id",
       "@timestamp",
-      "user_agent",
-      "alert_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "alert_id",
+      "created_at",
+      "alert_number"
     ],
     "docs_reference_titles": "About Dependabot alerts"
   },
@@ -13670,23 +20193,32 @@
     "description": "A Dependabot alert was manually dismissed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "alert_id",
-      "actor",
-      "repo",
       "created_at",
-      "org",
-      "_document_id",
-      "action",
-      "actor_id",
       "dismiss_reason",
-      "user",
       "dismiss_comment",
       "alert_number",
       "actor_is_bot"
@@ -13697,49 +20229,69 @@
     "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "public_repo",
       "owner",
-      "_document_id",
-      "@timestamp",
       "operation_type",
+      "alert_number"
+    ]
+  },
+  {
+    "action": "repository_vulnerability_alert.reopen",
+    "description": "A Dependabot alert was manually reopened.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number"
-    ]
-  },
-  {
-    "action": "repository_vulnerability_alert.reopen",
-    "description": "A Dependabot alert was manually reopened.",
-    "docs_reference_links": "N/A",
-    "fields": [
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "alert_id",
       "created_at",
-      "action",
-      "repo",
-      "repo_id",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo",
-      "alert_number",
-      "request_access_security_header"
+      "alert_number"
     ]
   },
   {
@@ -13747,21 +20299,32 @@
     "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "alert_id",
-      "repo",
-      "operation_type",
-      "action",
-      "repo_id",
-      "_document_id",
-      "user_agent",
-      "request_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "operation_type",
+      "created_at",
+      "alert_number"
     ]
   },
   {
@@ -13769,21 +20332,35 @@
     "description": "A Dependabot alert was withdrawn.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
       "created_at",
       "active",
-      "action",
-      "repository_id",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type"
     ]
   },
@@ -13792,20 +20369,30 @@
     "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
     "fields": [
-      "org",
+      "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
-      "operation_type",
-      "created_at",
-      "actor",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
   },
@@ -13814,24 +20401,31 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13839,26 +20433,32 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13866,23 +20466,30 @@
     "description": "Dependabot alerts was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "request_id",
-      "repo_id",
-      "action",
-      "actor_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "_document_id",
       "user_id",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13890,23 +20497,30 @@
     "description": "Dependabot alerts was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_agent",
-      "created_at",
       "@timestamp",
-      "repo_id",
+      "_document_id",
       "action",
-      "user",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor_id",
-      "_document_id",
-      "user_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -13915,24 +20529,31 @@
     "description": "A status check was marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "org",
-      "actor_id",
       "@timestamp",
-      "business",
-      "request_id",
-      "context",
-      "repo_id",
-      "action",
-      "repo",
       "_document_id",
-      "operation_type",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "created_at",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "context",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -13941,21 +20562,31 @@
     "description": "A status check was no longer marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "actor_id",
-      "actor",
-      "created_at",
-      "context",
-      "operation_type",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "repo_id",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
       "repo",
-      "programmatic_access_type"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "context",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -13964,18 +20595,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -13984,19 +20628,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -14005,22 +20661,33 @@
     "description": "A new custom repository role was created.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "role_permissions",
       "old_role_permissions"
     ],
@@ -14031,23 +20698,34 @@
     "description": "A custom repository role was deleted.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing custom repository roles for an organization"
   },
@@ -14056,23 +20734,34 @@
     "description": "A custom repository role was edited.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "old_role_permissions",
       "old_base_role"
     ],
@@ -14083,14 +20772,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -14104,14 +20807,28 @@
     "description": "A secret scanning alert was leaked in a public repo.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -14126,22 +20843,32 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
@@ -14150,14 +20877,28 @@
     "description": "A leaked secret was reported to the secret's provider by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "created_at",
@@ -14172,28 +20913,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -14201,25 +20951,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -14227,14 +20984,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -14251,19 +21022,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14272,19 +21054,30 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14293,20 +21086,30 @@
     "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14315,19 +21118,30 @@
     "description": "Secret scanning was enabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14336,14 +21150,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -14361,25 +21189,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14388,25 +21224,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -14416,25 +21260,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -14443,10 +21295,28 @@
     "description": "A security configuration was created",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -14461,15 +21331,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14487,22 +21350,33 @@
     "description": "A default security configuration setting for new repositories was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14511,22 +21385,33 @@
     "description": "A default security configuration setting for new repositories was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14535,10 +21420,28 @@
     "description": "A security configuration was deleted",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -14553,15 +21456,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14578,15 +21474,30 @@
     "description": "A security configuration policy was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enforcement",
       "security_configuration_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14596,10 +21507,28 @@
     "description": "A security configuration was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -14614,15 +21543,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14640,16 +21562,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14659,18 +21594,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -14679,16 +21627,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14698,15 +21659,28 @@
     "description": "An agreement for invoiced billing for GitHub Sponsors was signed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -14718,15 +21692,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -14736,15 +21723,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -14753,17 +21755,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -14772,17 +21787,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -14791,16 +21820,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -14810,14 +21852,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -14827,17 +21884,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -14845,18 +21915,31 @@
     "action": "sponsors.sponsored_developer_create",
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
-    "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
+    "fields": [
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -14865,18 +21948,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -14885,15 +21981,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -14903,16 +22013,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14920,15 +22043,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -14939,16 +22075,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -14958,17 +22107,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -14979,17 +22141,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -15000,18 +22175,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15021,16 +22207,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15040,16 +22239,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15061,17 +22273,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15080,19 +22305,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15101,21 +22339,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "user",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
       "action",
-      "user_id",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "actor_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15124,19 +22371,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15145,15 +22403,28 @@
     "description": "Dependabot encrypted config was read.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "public_repo"
@@ -15164,20 +22435,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15185,18 +22470,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -15204,16 +22504,31 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "domain_name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15221,23 +22536,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15245,23 +22570,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15269,23 +22604,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15293,23 +22638,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15317,21 +22672,31 @@
     "description": "A member of an organization was added to a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
-      "user",
       "@timestamp",
-      "actor_id",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "org",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -15341,22 +22706,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -15365,20 +22739,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -15387,18 +22772,31 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
       "created_at",
       "operation_type",
-      "actor_id",
-      "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
@@ -15408,21 +22806,32 @@
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -15431,21 +22840,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -15454,19 +22873,31 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "team",
       "org_id",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
       "operation_type",
-      "_document_id",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -15475,19 +22906,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
       "business",
-      "action",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15495,19 +22937,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "request_id",
       "actor",
-      "org",
-      "created_at",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15515,18 +22968,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
       "@timestamp",
-      "action",
       "_document_id",
-      "user_agent",
-      "user_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -15535,19 +22999,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "actor",
-      "action",
-      "operation_type",
-      "team",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -15555,19 +23031,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "actor_id",
       "_document_id",
-      "team",
-      "created_at",
-      "org_id",
       "action",
-      "request_id",
-      "user_agent",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_access_security_header"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "team",
+      "created_at"
     ]
   },
   {
@@ -15575,22 +23063,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "team",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15598,22 +23095,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -15622,22 +23128,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -15645,23 +23160,33 @@
   {
     "action": "team.remove_repository",
     "description": "A repository was removed from a team's control.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "org",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -15669,21 +23194,32 @@
     "description": "A team's name was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "user_agent",
-      "created_at",
-      "team",
-      "operation_type",
-      "actor_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -15692,17 +23228,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -15711,19 +23260,30 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -15732,19 +23292,30 @@
     "description": "The Okta credentials for team synchronization with a tenant were changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -15752,28 +23323,37 @@
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
       "operation_type",
       "created_at",
-      "user_agent",
       "permission",
       "new_repo_permission",
       "new_repo_base_role",
       "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_repo_base_role"
     ]
   },
   {
@@ -15781,16 +23361,30 @@
     "description": "A Dependabot rule was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15800,16 +23394,30 @@
     "description": "A Dependabot rule was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15819,18 +23427,31 @@
     "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15840,21 +23461,33 @@
     "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15862,21 +23495,32 @@
     "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -15884,21 +23528,32 @@
     "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -15906,16 +23561,30 @@
     "description": "A Dependabot rule's conditions, actions, or metadata changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15925,27 +23594,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -15954,23 +23629,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -15978,10 +23663,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -15992,20 +23695,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -16014,23 +23706,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16040,10 +23740,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -16055,19 +23773,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -16078,10 +23786,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -16090,21 +23816,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -16114,23 +23829,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -16139,22 +23866,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16162,21 +23900,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -16184,25 +23933,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16210,23 +23967,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -16240,24 +24010,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -16266,10 +24045,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -16279,21 +24076,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -16303,25 +24090,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.16/user.json b/src/audit-logs/data/ghes-3.16/user.json
index 62161498f9ce..b8a542124b3e 100644
--- a/src/audit-logs/data/ghes-3.16/user.json
+++ b/src/audit-logs/data/ghes-3.16/user.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,17 +67,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
-      "user_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -61,18 +98,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
+      "token_scopes",
       "user",
-      "request_id",
-      "_document_id",
-      "user_agent",
-      "actor",
       "user_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -80,18 +129,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "token_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -99,29 +160,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -129,18 +196,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -148,17 +227,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -167,19 +259,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -188,18 +292,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -207,18 +324,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -226,15 +355,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -244,26 +386,36 @@
     "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -271,24 +423,34 @@
     "description": "A CSV export was requested on the \"Coverage\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -296,26 +458,36 @@
     "description": "A CSV export was requested on the \"Overview Dashboard\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -323,20 +495,31 @@
     "description": "A CSV export was requested on the \"Risk\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -347,17 +530,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -368,20 +564,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -390,19 +598,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -411,19 +632,31 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -432,20 +665,32 @@
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -454,19 +699,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -475,20 +732,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -497,20 +765,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -521,17 +800,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -539,14 +830,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -556,25 +862,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -585,22 +900,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -612,22 +938,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -636,36 +973,64 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "public_repo"
-    ]
-  },
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "owner",
+      "created_at",
+      "operation_type",
+      "public_repo"
+    ]
+  },
   {
     "action": "codespaces.restore",
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -675,27 +1040,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "org",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -703,19 +1077,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -723,18 +1110,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -743,23 +1142,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -767,16 +1173,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -785,24 +1205,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -810,15 +1236,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -828,40 +1267,62 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "copilot.cfb_seat_cancelled",
-    "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "copilot.cfb_seat_cancelled",
+    "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -869,21 +1330,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -891,21 +1361,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -915,19 +1394,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -937,21 +1425,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -961,19 +1458,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -982,19 +1490,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1003,19 +1522,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1024,19 +1554,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1045,17 +1586,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1063,19 +1617,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1084,19 +1649,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1104,19 +1680,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1125,19 +1712,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1145,19 +1743,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1166,19 +1775,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1186,19 +1806,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1207,43 +1838,62 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "environment.add_protection_rule",
-    "description": "A GitHub Actions deployment protection rule was created via the API.",
-    "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "environment.add_protection_rule",
+    "description": "A GitHub Actions deployment protection rule was created via the API.",
+    "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1252,22 +1902,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1275,28 +1935,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1305,27 +1971,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1334,25 +2008,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1361,26 +2043,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1389,21 +2078,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1412,23 +2113,33 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
-    ],
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "public_repo"
+    ],
     "docs_reference_titles": "Managing environments for deployment"
   },
   {
@@ -1436,25 +2147,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1463,22 +2183,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1487,21 +2219,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -1512,21 +2254,32 @@
     "description": "A gist was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "gist_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "visibility",
-      "action",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ]
   },
   {
@@ -1534,20 +2287,32 @@
     "description": "A gist was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "gist_id",
-      "visibility",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "user",
-      "request_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "programmatic_access_type"
+      "gist_id",
+      "visibility",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1555,21 +2320,32 @@
     "description": "The visibility of a gist was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "user",
-      "gist_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "visibility",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "gist_id",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -1577,22 +2353,33 @@
     "description": "An SSH key was added to a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1601,23 +2388,34 @@
     "description": "An SSH key was removed from a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
       "explanation",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1626,23 +2424,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1650,18 +2457,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1672,20 +2489,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1695,18 +2522,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "user",
-      "operation_type",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1714,18 +2553,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1733,25 +2584,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -1759,25 +2620,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -1785,26 +2655,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -1813,25 +2692,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -1839,26 +2727,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
-      "repo",
-      "operation_type",
-      "action",
-      "_document_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
+      "operation_type",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -1866,21 +2763,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -1889,19 +2797,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -1909,21 +2830,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -1932,19 +2864,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -1955,20 +2901,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -1978,24 +2936,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2006,23 +2975,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2033,20 +3014,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2056,19 +3050,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -2077,20 +3085,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -2100,20 +3121,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -2122,20 +3156,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -2144,20 +3191,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2165,19 +3224,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2186,19 +3258,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2207,17 +3292,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2230,21 +3328,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -2258,17 +3369,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2280,18 +3404,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2299,21 +3435,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -2321,21 +3470,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2343,22 +3505,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -2366,19 +3541,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -2389,21 +3577,36 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
       "marketplace_listing",
       "has_free_trial",
-      "user_agent",
-      "request_id",
-      "actor_id",
       "yearly_price_in_cents",
       "description",
       "bullets",
       "monthly_price_in_cents",
-      "marketplace_listing_plan",
-      "_document_id"
+      "marketplace_listing_plan"
     ]
   },
   {
@@ -2411,22 +3614,37 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "marketplace_listing_plan",
       "marketplace_listing",
       "description",
       "bullets",
       "has_free_trial",
       "created_at",
-      "actor_id",
       "operation_type",
-      "_document_id",
-      "action",
-      "user_agent",
-      "request_id",
-      "actor",
       "monthly_price_in_cents",
-      "yearly_price_in_cents",
-      "@timestamp"
+      "yearly_price_in_cents"
     ]
   },
   {
@@ -2434,21 +3652,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "marketplace_listing_plan",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "marketplace_listing_plan",
       "description",
       "yearly_price_in_cents",
-      "@timestamp",
       "created_at",
-      "actor_id",
       "bullets",
       "has_free_trial",
       "marketplace_listing",
-      "user_agent",
       "monthly_price_in_cents",
-      "action",
       "operation_type"
     ]
   },
@@ -2457,21 +3690,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "monthly_price_in_cents",
-      "marketplace_listing",
+      "@timestamp",
       "_document_id",
       "action",
-      "description",
-      "bullets",
-      "yearly_price_in_cents",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "monthly_price_in_cents",
+      "marketplace_listing",
+      "description",
+      "bullets",
+      "yearly_price_in_cents",
       "has_free_trial",
       "marketplace_listing_plan",
-      "user_agent",
-      "@timestamp",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -2480,22 +3728,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -2503,22 +3764,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2526,19 +3800,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2546,21 +3832,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2570,16 +3865,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2589,18 +3897,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2610,14 +3931,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2625,19 +3962,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -2645,42 +3993,62 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "org",
-      "created_at",
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "migration.create",
-    "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "repo",
-      "org_id",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "migration.create",
+    "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "user_agent",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -2688,20 +4056,30 @@
     "description": "An OAuth access token was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
     "fields": [
-      "_document_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "user",
-      "user_id",
-      "created_at",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "request_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
@@ -2712,19 +4090,30 @@
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "explanation",
-      "hashed_token",
-      "actor_id",
-      "token_scopes",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
@@ -2734,19 +4123,30 @@
     "description": "An OAuth access token was regenerated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "_document_id",
-      "created_at",
       "@timestamp",
-      "operation_type",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ]
   },
@@ -2755,18 +4155,30 @@
     "description": "An OAuth access token was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2774,20 +4186,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2796,20 +4220,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2818,20 +4254,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2840,20 +4288,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2862,19 +4322,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2883,20 +4356,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2905,20 +4390,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2927,19 +4424,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2948,24 +4458,31 @@
     "description": "An authorization for an OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "user_id",
-      "actor",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
       "actor_id",
-      "user",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "actor_is_bot",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -2975,20 +4492,31 @@
     "description": "An authorization for an OAuth application was deleted.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "actor",
       "created_at",
       "explanation",
-      "user",
-      "user_id",
-      "org_id",
-      "action",
-      "actor_id",
-      "token_scopes",
       "actor_is_bot",
       "oauth_application_name"
     ],
@@ -2999,20 +4527,31 @@
     "description": "An authorization for an OAuth application was updated.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
-      "actor_id",
       "user_agent",
-      "@timestamp",
       "operation_type",
-      "action",
-      "user",
       "created_at",
-      "_document_id",
       "actor_is_bot",
-      "request_access_security_header",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -3022,21 +4561,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -3045,24 +4594,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3070,20 +4629,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3091,22 +4660,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3114,20 +4691,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3135,22 +4722,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3158,21 +4753,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3180,26 +4784,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -3208,26 +4821,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3235,28 +4856,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3264,26 +4893,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3291,20 +4928,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -3313,16 +4961,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -3333,18 +4994,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -3353,18 +5027,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -3373,18 +5059,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -3393,18 +5092,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -3414,20 +5125,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -3435,17 +5157,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -3455,20 +5190,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -3477,20 +5223,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
-      "owner_type",
-      "domain",
-      "state",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
+      "owner_type",
+      "domain",
+      "state",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -3499,17 +5259,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3520,20 +5295,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -3542,19 +5331,31 @@
     "description": "A new passkey was added.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3562,19 +5363,31 @@
     "description": "A new passkey was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3582,18 +5395,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3601,16 +5426,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3618,18 +5457,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3637,18 +5488,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3659,18 +5523,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3681,17 +5558,30 @@
     "description": "Triggered when you create a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3701,19 +5591,31 @@
     "description": "Triggered when you regenerate a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3721,12 +5623,29 @@
     "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
     "fields": [
-      "user_programmatic_access_name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
       "operation_type"
     ],
@@ -3737,20 +5656,32 @@
     "description": "Triggered when you delete a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "explanation",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3758,17 +5689,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -3779,18 +5723,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -3802,17 +5759,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -3824,17 +5794,30 @@
     "description": "A fine-grained personal access token was updated.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3845,15 +5828,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3863,35 +5861,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type"
-    ]
-  },
-  {
-    "action": "premium_runner.update",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "premium_runner.update",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3901,17 +5925,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3921,17 +5956,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3941,17 +5987,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3961,17 +6018,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3981,17 +6049,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -4001,17 +6082,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4019,20 +6113,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -4042,25 +6147,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -4068,20 +6185,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4089,25 +6218,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4115,17 +6256,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4133,17 +6287,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4151,18 +6318,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -4171,18 +6350,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -4191,19 +6382,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -4211,17 +6413,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -4233,79 +6448,125 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
-    ]
-  },
-  {
-    "action": "project.unlink",
-    "description": "A repository was unlinked from a project board.",
-    "docs_reference_links": "N/A",
-    "fields": [
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "operation_type",
-      "actor",
-      "action",
-      "created_at",
-      "actor_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
-    "action": "project.update_org_permission",
-    "description": "The project's base-level permission for all organization members was changed or removed.",
+    "action": "project.unlink",
+    "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
-      "org_id",
-      "user_agent"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
-    "action": "project.update_team_permission",
-    "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
+    "action": "project.update_org_permission",
+    "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "team",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "project.update_team_permission",
+    "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -4313,20 +6574,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4334,18 +6605,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -4354,18 +6637,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -4374,16 +6669,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -4395,21 +6703,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -4417,18 +6737,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4439,49 +6772,71 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "key",
-      "fingerprint",
-      "actor",
       "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
-    ],
-    "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
-  },
-  {
-    "action": "public_key.delete",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
+      "operation_type",
+      "created_at",
+      "key",
+      "fingerprint",
+      "title"
+    ],
+    "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
+  },
+  {
+    "action": "public_key.delete",
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -4490,20 +6845,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4512,21 +6881,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -4536,22 +6918,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4560,25 +6954,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4587,23 +6991,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4612,22 +7027,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -4636,21 +7061,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -4659,25 +7093,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -4686,23 +7127,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -4711,24 +7160,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -4737,23 +7193,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -4763,22 +7227,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -4787,19 +7260,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -4808,24 +7294,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -4834,23 +7330,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4861,34 +7366,60 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "actor",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
-    ],
-    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
-  },
-  {
-    "action": "repo.config.disable_contributors_only",
-    "description": "The interaction limit for prior contributors only was disabled in a repository.",
-    "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
-    "fields": [
-      "repo",
-      "@timestamp",
-      "request_id",
       "actor",
-      "_document_id",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+  },
+  {
+    "action": "repo.config.disable_contributors_only",
+    "description": "The interaction limit for prior contributors only was disabled in a repository.",
+    "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -4899,16 +7430,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -4918,17 +7462,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -4938,19 +7495,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -4959,17 +7527,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -4978,26 +7559,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -5006,30 +7593,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -5039,20 +7631,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5061,25 +7664,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5088,23 +7699,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5112,25 +7734,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -5140,23 +7771,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -5164,21 +7805,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5186,21 +7837,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -5208,22 +7869,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5231,21 +7901,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -5253,43 +7933,63 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ]
-  },
-  {
-    "action": "repo.pages_public",
-    "description": "A GitHub Pages site visibility was changed to public.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "visibility",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org",
-      "org_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "repo.pages_public",
+    "description": "A GitHub Pages site visibility was changed to public.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5297,18 +7997,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5316,22 +8030,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5339,21 +8063,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5361,18 +8095,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -5381,22 +8127,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5405,24 +8160,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5431,50 +8194,65 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "public_repo",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "repo.remove_member",
-    "description": "A collaborator was removed from a repository.",
-    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
-    "fields": [
-      "request_id",
-      "user",
-      "business",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
+      "created_at",
+      "public_repo"
+    ]
+  },
+  {
+    "action": "repo.remove_member",
+    "description": "A collaborator was removed from a repository.",
+    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
+    "fields": [
       "@timestamp",
       "_document_id",
-      "visibility",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -5483,21 +8261,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -5506,25 +8293,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5532,22 +8325,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -5556,19 +8359,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5576,23 +8390,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -5602,20 +8425,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -5626,21 +8460,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -5649,22 +8494,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -5673,21 +8528,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -5696,22 +8562,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -5722,16 +8598,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -5740,22 +8627,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -5765,22 +8661,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -5789,23 +8696,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5815,19 +8732,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -5835,21 +8762,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -5858,24 +8795,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5883,25 +8829,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5910,24 +8863,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -5936,25 +8899,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5963,22 +8934,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -5987,26 +8967,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -6014,31 +9002,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6047,21 +9042,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -6069,21 +9074,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6091,21 +9106,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -6113,20 +9139,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6134,21 +9172,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6156,19 +9205,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -6176,31 +9238,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -6209,19 +9279,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -6229,8 +9310,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -6239,23 +9319,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -6280,18 +9369,30 @@
     "description": "A security key was registered for an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6299,18 +9400,30 @@
     "description": "A security key was removed from an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6318,37 +9431,63 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type"
-    ]
-  },
-  {
-    "action": "sponsors.custom_amount_settings_change",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sponsors_listing_id",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "sponsors.custom_amount_settings_change",
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -6357,16 +9496,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6377,15 +9529,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -6395,15 +9560,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -6412,17 +9592,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -6431,17 +9624,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -6450,16 +9657,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -6469,14 +9689,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -6486,17 +9721,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -6505,37 +9753,63 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
-      "user_agent",
-      "actor"
-    ],
-    "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
   {
     "action": "sponsors.sponsored_developer_disable",
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6544,15 +9818,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -6562,16 +9850,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6579,15 +9880,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -6598,16 +9912,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -6617,17 +9944,30 @@
     "description": "Triggered when you send an email update to your sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
     "fields": [
-      "request_id",
-      "actor",
-      "action",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
   },
@@ -6636,17 +9976,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -6657,17 +10010,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -6678,18 +10044,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6699,16 +10076,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6718,17 +10108,30 @@
     "description": "You join the waitlist to join GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "actor_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -6737,16 +10140,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6756,23 +10172,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6780,23 +10206,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6804,23 +10240,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6828,23 +10274,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6852,15 +10308,30 @@
     "description": "Triggered when you accept a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6869,15 +10340,30 @@
     "description": "Triggered when you cancel a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6886,32 +10372,62 @@
     "description": "Triggered when you create a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
-  },
-  {
-    "action": "successor_invitation.decline",
-    "description": "Triggered when you decline a succession invitation.",
-    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
+  },
+  {
+    "action": "successor_invitation.decline",
+    "description": "Triggered when you decline a succession invitation.",
+    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
+    "fields": [
       "@timestamp",
-      "created_at",
-      "_document_id"
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6920,15 +10436,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6936,15 +10467,30 @@
     "description": "Triggered when you revoke a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6953,17 +10499,30 @@
     "description": "A new trusted device was added.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6971,17 +10530,30 @@
     "description": "A trusted device was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6989,14 +10561,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "action",
-      "request_id",
-      "user_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -7005,15 +10592,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "created_at",
-      "user_id",
-      "operation_type",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7021,13 +10623,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "created_at",
-      "user_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7035,17 +10654,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "operation_type",
-      "action",
-      "_document_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7053,17 +10685,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor",
-      "action",
       "@timestamp",
-      "user_agent",
-      "operation_type",
-      "user",
-      "created_at",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "_document_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7071,16 +10716,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7088,15 +10747,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "user",
       "_document_id",
-      "request_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7104,18 +10778,30 @@
     "description": "A secondary authentication factor was added to a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -7124,18 +10810,30 @@
     "description": "Two-factor authentication was disabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
     "fields": [
-      "actor",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_id",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Disabling two-factor authentication for your personal account"
   },
@@ -7144,18 +10842,30 @@
     "description": "Two-factor authentication was enabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
-      "actor",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Configuring two-factor authentication"
   },
@@ -7164,15 +10874,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user",
-      "user_id",
-      "action",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "user_agent"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7180,16 +10905,29 @@
     "description": "Two factor recovery codes were regenerated for a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
+      "operation_type",
       "created_at"
     ]
   },
@@ -7198,18 +10936,30 @@
     "description": "A secondary authentication factor was removed from a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -7218,15 +10968,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "created_at",
-      "_document_id",
-      "action",
-      "@timestamp"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7235,16 +11000,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
-      "operation_type",
-      "user_agent",
       "action",
-      "request_id",
       "actor",
-      "actor_id"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7252,19 +11030,31 @@
     "description": "An email address was added to a user account.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "actor_id",
-      "actor",
       "email",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding an email address to your GitHub account"
   },
@@ -7273,18 +11063,30 @@
     "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "created_at",
-      "user",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7292,15 +11094,28 @@
     "description": "Audit log entries were exported.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "action",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ]
@@ -7310,20 +11125,31 @@
     "description": "A user was blocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_id",
-      "_document_id",
       "actor_id",
-      "@timestamp",
-      "user_agent",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7331,18 +11157,30 @@
     "description": "A user changed their password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "actor_id",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7350,18 +11188,30 @@
     "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -7370,17 +11220,30 @@
     "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -7389,81 +11252,128 @@
     "description": "A new user account was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "email",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "created_at",
       "_document_id",
-      "user_agent",
-      "actor",
-      "actor_id",
       "action",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "user.create_integration_secret",
-    "description": "A user secret for Codespaces was created.",
-    "docs_reference_links": "N/A",
-    "fields": [
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "visibility",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
+      "user_agent",
+      "email",
       "operation_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
-    "action": "user.creation_rate_limit_exceeded",
-    "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
+    "action": "user.create_integration_secret",
+    "description": "A user secret for Codespaces was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "oauth_application_id",
       "action",
       "actor",
       "actor_id",
-      "request_id",
-      "user_id",
-      "@timestamp",
-      "token_scopes",
-      "programmatic_access_type"
-    ]
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "visibility",
+      "integration",
+      "created_at",
+      "operation_type"
+    ]
   },
   {
-    "action": "user.delete",
-    "description": "A user account was destroyed by an asynchronous job.",
+    "action": "user.creation_rate_limit_exceeded",
+    "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
+    ]
+  },
+  {
+    "action": "user.delete",
+    "description": "A user account was destroyed by an asynchronous job.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
       "_document_id",
-      "request_access_security_header"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7472,19 +11382,30 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "oauth_application_id",
+      "_document_id",
       "action",
-      "user",
-      "created_at",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7492,18 +11413,30 @@
     "description": "A user deleted his or her account, triggering user.async_delete.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
-      "created_at",
-      "user_agent",
       "user_id",
-      "operation_type",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7511,18 +11444,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "user_agent",
       "user_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7530,18 +11475,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "_document_id",
-      "@timestamp",
-      "user",
-      "actor_id",
-      "action",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7550,17 +11507,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "request_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7568,17 +11537,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7586,17 +11568,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7604,17 +11599,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7622,21 +11630,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7644,21 +11662,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -7667,17 +11695,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7685,17 +11726,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7703,17 +11757,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7721,18 +11788,30 @@
     "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "org_id",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7740,17 +11819,31 @@
     "description": "A user requested a password reset.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
     "fields": [
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "email",
-      "created_at",
-      "user_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
   },
@@ -7759,17 +11852,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "created_at",
-      "user_agent",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "request_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7777,18 +11883,30 @@
     "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -7797,19 +11915,31 @@
     "description": "A user signed in.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "actor_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "_document_id",
-      "request_id",
       "created_at",
-      "actor",
-      "passkey_nickname",
-      "request_access_security_header"
+      "passkey_nickname"
     ]
   },
   {
@@ -7817,18 +11947,30 @@
     "description": "A user signed out.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7836,18 +11978,30 @@
     "description": "A user signed in from a new device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7855,21 +12009,31 @@
     "description": "An ordinary user account was promoted to a site administrator.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
+      "user_id",
       "user_agent",
+      "created_at",
       "oauth_application_id",
-      "request_id",
-      "operation_type",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7877,16 +12041,29 @@
     "description": "A user's account was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user",
-      "action",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "operation_type"
     ]
   },
@@ -7895,20 +12072,31 @@
     "description": "An email address was removed from a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "actor_id",
       "created_at",
-      "email",
-      "token_scopes",
-      "programmatic_access_type"
+      "email"
     ]
   },
   {
@@ -7916,20 +12104,32 @@
     "description": "A user secret for Codespaces was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "key",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7937,20 +12137,31 @@
     "description": "A username was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "request_id",
-      "actor_id",
-      "old_login",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_login",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7958,18 +12169,30 @@
     "description": "A user reset their account password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7977,16 +12200,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -7997,16 +12233,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -8015,18 +12263,30 @@
     "description": "A user signed in from an unrecognized device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor",
-      "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8034,18 +12294,30 @@
     "description": "A user signed in from an unrecognized device and location.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "created_at",
-      "_document_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8053,22 +12325,33 @@
     "description": "Triggered when you clear the status on your profile.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "message",
-      "user",
-      "actor_id",
       "created_at",
-      "request_id",
       "limited_availability",
-      "action",
       "emoji",
-      "operation_type",
-      "user_agent",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8076,23 +12359,33 @@
     "description": "Triggered when you set or change the status on your profile.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
     "fields": [
-      "limited_availability",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "message",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "limited_availability",
+      "message",
+      "created_at",
       "emoji",
-      "org",
-      "actor",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
   },
@@ -8101,21 +12394,31 @@
     "description": "A user account was suspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "user_agent",
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "token_scopes",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8123,18 +12426,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
-      "actor_id",
       "@timestamp",
-      "operation_type",
       "_document_id",
-      "user_agent",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8142,18 +12457,30 @@
     "description": "A 2FA challenge issued for a user account failed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "actor_id",
-      "actor",
-      "user_id",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8163,16 +12490,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
       "user_agent",
-      "request_id",
-      "action",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8180,18 +12519,30 @@
     "description": "A user used their 2FA recovery codes.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
       "user_agent",
-      "request_id",
-      "user",
-      "action",
-      "actor",
-      "actor_id",
-      "created_at",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8199,18 +12550,30 @@
     "description": "A user downloaded 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8218,17 +12581,30 @@
     "description": "A user printed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8236,18 +12612,30 @@
     "description": "A user viewed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
       "created_at",
-      "user",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8255,17 +12643,30 @@
     "description": "A user was prompted for a two-factor authentication code.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
     "fields": [
-      "user",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "actor"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
   },
@@ -8274,19 +12675,31 @@
     "description": "A user was unblocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "user_agent",
-      "user_id",
-      "user",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8294,21 +12707,31 @@
     "description": "A user account was unsuspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "user_agent",
       "actor",
-      "oauth_application_id",
-      "operation_type",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "user_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8316,21 +12739,33 @@
     "description": "A user secret for Codespaces was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8338,46 +12773,64 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "workflows.approve_workflow_job",
+    "description": "A workflow job was approved.",
+    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "workflows.approve_workflow_job",
-    "description": "A workflow job was approved.",
-    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
-    "fields": [
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "workflow_run_id",
       "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -8386,23 +12839,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8410,23 +12873,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8436,23 +12907,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -8461,22 +12944,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8484,21 +12978,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -8506,25 +13011,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8532,24 +13045,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -8558,25 +13080,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.17/enterprise.json b/src/audit-logs/data/ghes-3.17/enterprise.json
index dd8c56641d70..7b3d5fe69cc2 100644
--- a/src/audit-logs/data/ghes-3.17/enterprise.json
+++ b/src/audit-logs/data/ghes-3.17/enterprise.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,17 +67,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
-      "user_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -61,18 +98,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
+      "token_scopes",
       "user",
-      "request_id",
-      "_document_id",
-      "user_agent",
-      "actor",
       "user_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -80,18 +129,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "token_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -99,29 +160,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -129,31 +196,34 @@
     "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "query_string",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "request_body",
-      "status_code",
-      "url_path",
       "business",
       "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "request_method",
+      "query_string",
+      "request_body",
+      "status_code",
+      "url_path",
+      "public_repo",
       "created_at",
       "operation_type",
       "route",
@@ -167,18 +237,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -186,20 +268,32 @@
     "description": "A manual check of the endpoint configured for audit log streaming was performed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "audit_log_stream_result",
-      "business_id",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_result",
       "created_at",
       "operation_type",
-      "audit_log_stream_sink_details",
-      "request_access_security_header"
+      "audit_log_stream_sink_details"
     ]
   },
   {
@@ -207,18 +301,31 @@
     "description": "An endpoint was added for audit log streaming.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "business_id",
       "business",
-      "audit_log_stream_sink",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_sink",
+      "created_at",
+      "operation_type",
       "audit_log_stream_id"
     ]
   },
@@ -227,15 +334,28 @@
     "description": "An audit log streaming endpoint was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "business_id",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "audit_log_stream_id",
@@ -247,17 +367,30 @@
     "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "audit_log_stream_enabled",
-      "business_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_enabled",
       "audit_log_stream_sink",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "new_s3_bucket",
@@ -280,17 +413,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -299,19 +445,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -320,18 +478,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -339,18 +510,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -358,15 +541,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -376,22 +572,31 @@
     "description": "An enterprise owner was added to an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
     "fields": [
-      "name",
-      "business",
-      "user",
-      "user_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "request_id",
+      "business",
       "business_id",
-      "_document_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Inviting people to manage your enterprise"
   },
@@ -400,22 +605,32 @@
     "description": "An organization was added to an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "operation_type",
       "name",
       "created_at",
-      "request_id",
-      "_document_id",
-      "business",
-      "organization_upgrade",
-      "request_access_security_header"
+      "organization_upgrade"
     ]
   },
   {
@@ -423,20 +638,30 @@
     "description": "GitHub Advanced Security was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -445,17 +670,28 @@
     "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -466,21 +702,31 @@
     "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -489,17 +735,28 @@
     "description": "GitHub Advanced Security was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -510,17 +767,28 @@
     "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -531,21 +799,31 @@
     "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -554,20 +832,32 @@
     "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "new_policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "new_policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -576,20 +866,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -597,17 +899,28 @@
     "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -619,21 +932,31 @@
     "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -642,18 +965,31 @@
     "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -662,17 +998,30 @@
     "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
     "fields": [
-      "name",
-      "operation_type",
-      "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "actor",
+      "@timestamp",
       "_document_id",
-      "business",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -682,19 +1031,32 @@
     "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
-      "action",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "business",
       "visibility",
       "created_at",
-      "actor",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -703,21 +1065,33 @@
     "description": "The policy for Code scanning autofix was updated for an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -725,21 +1099,33 @@
     "description": "The policy for Code scanning autofix third party tools was updated for an enterprise.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/getting-started/github-security-features#available-with-github-code-security"
   },
@@ -748,18 +1134,30 @@
     "description": "The policy for Code Security enablement was updated for an enterprise.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -771,19 +1169,31 @@
     "description": "An enterprise was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "request_id",
-      "name",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "operation_type",
-      "actor",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -791,17 +1201,28 @@
     "description": "Dependabot alerts were disabled for new repositories in your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -811,17 +1232,28 @@
     "description": "Dependabot alerts were enabled for new repositories in your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -831,17 +1263,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -851,18 +1296,30 @@
     "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -870,17 +1327,28 @@
     "description": "Display of IP addresses within audit log events for the enterprise was disabled.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -891,18 +1359,31 @@
     "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "business_id",
-      "actor_id",
-      "name",
-      "_document_id",
-      "request_id"
+      "name"
     ]
   },
   {
@@ -910,15 +1391,28 @@
     "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -928,17 +1422,28 @@
     "description": "Display of IP addresses within audit log events for the enterprise was enabled.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -949,18 +1454,31 @@
     "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "operation_type",
-      "created_at",
+      "actor_id",
       "business",
       "business_id",
-      "name",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ]
   },
   {
@@ -968,20 +1486,31 @@
     "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
       "business",
-      "name",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "business_id",
-      "_document_id"
+      "created_at",
+      "name",
+      "operation_type"
     ]
   },
   {
@@ -989,20 +1518,31 @@
     "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1010,20 +1550,31 @@
     "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "business",
-      "actor_id",
-      "created_at",
-      "action",
+      "user_id",
       "user_agent",
-      "request_id",
-      "user_id"
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1031,20 +1582,31 @@
     "description": "An enterprise owner was removed from an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
-      "user_agent",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "name",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
-      "user"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ],
     "docs_reference_titles": "Inviting people to manage your enterprise"
   },
@@ -1053,20 +1615,31 @@
     "description": "An organization was removed from an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "business",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "business_id",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "name",
-      "org"
+      "name"
     ]
   },
   {
@@ -1074,18 +1647,31 @@
     "description": "The slug for the enterprise URL was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "name",
-      "business_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
-      "@timestamp",
-      "created_at",
+      "actor_id",
       "business",
-      "_document_id"
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1093,20 +1679,31 @@
     "description": "The SAML single sign-on session for a member in an enterprise was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "_document_id",
-      "actor_id",
       "name",
-      "@timestamp",
-      "user_id",
-      "action",
-      "created_at",
-      "business"
+      "created_at"
     ]
   },
   {
@@ -1114,17 +1711,28 @@
     "description": "Automatic partner validation checks have been disabled at the business level",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1135,17 +1743,28 @@
     "description": "Automatic partner validation checks have been enabled at the business level",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1156,20 +1775,30 @@
     "description": "An enterprise-level custom pattern was created for secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -1178,17 +1807,28 @@
     "description": "An enterprise-level custom pattern was removed from secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1198,20 +1838,30 @@
     "description": "An enterprise-level custom pattern was published for secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1219,17 +1869,28 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1240,20 +1901,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -1262,17 +1933,28 @@
     "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1282,17 +1964,28 @@
     "description": "Secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1303,17 +1996,28 @@
     "description": "Secret scanning was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1324,17 +2028,28 @@
     "description": "Secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1345,17 +2060,28 @@
     "description": "Secret scanning was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1366,17 +2092,28 @@
     "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1388,17 +2125,28 @@
     "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1410,17 +2158,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1431,17 +2190,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1452,17 +2222,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1473,17 +2254,28 @@
     "description": "Push protection for secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1494,17 +2286,28 @@
     "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1515,17 +2318,28 @@
     "description": "Push protection for secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1536,17 +2350,28 @@
     "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1557,20 +2382,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1578,26 +2415,36 @@
     "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1605,24 +2452,34 @@
     "description": "A CSV export was requested on the \"Coverage\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1630,26 +2487,36 @@
     "description": "A CSV export was requested on the \"Overview Dashboard\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1657,20 +2524,31 @@
     "description": "A CSV export was requested on the \"Risk\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1681,17 +2559,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -1702,20 +2593,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1724,40 +2627,65 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
-  },
-  {
-    "action": "business.set_default_workflow_permissions",
-    "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
-    "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
-    "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
+      "limit",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+  },
+  {
+    "action": "business.set_default_workflow_permissions",
+    "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
+    "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1766,20 +2694,32 @@
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1788,19 +2728,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1809,20 +2761,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "issuer",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
       "business_id",
-      "actor_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "issuer",
+      "name",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1830,18 +2794,31 @@
     "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "updated_github_owned_allowed",
       "updated_verified_allowed",
       "updated_patterns",
@@ -1856,20 +2833,33 @@
     "description": "The base repository permission setting was updated for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
     "fields": [
-      "business_id",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "permission",
-      "action",
       "created_at",
-      "@timestamp",
-      "request_id",
       "name",
-      "_document_id",
-      "old_permission",
-      "business"
+      "old_permission"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -1878,19 +2868,32 @@
     "description": "The repository creation setting was updated for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "name",
-      "business_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "operation_type",
-      "permission",
-      "action",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "name",
+      "operation_type",
+      "permission",
       "visibility"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -1900,19 +2903,32 @@
     "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories",
     "fields": [
-      "business_id",
-      "created_at",
-      "action",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "permission",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "business"
+      "created_at",
+      "operation_type",
+      "permission",
+      "name"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -1921,20 +2937,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -1943,20 +2970,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -1967,17 +3005,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1985,15 +3035,31 @@
     "description": "Existing code scanning alerts appeared in a branch.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2003,15 +3069,31 @@
     "description": "Code scanning alerts were fixed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2021,15 +3103,31 @@
     "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_numbers",
       "commit_oid",
-      "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business"
+      "ref"
     ],
     "docs_reference_titles": "About code scanning"
   },
@@ -2038,15 +3136,29 @@
     "description": "Code scanning alerts were manually dismissed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers",
       "dismissal_approver_id"
     ],
@@ -2057,19 +3169,31 @@
     "description": "Dismissal of code scanning alerts was approved.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2080,19 +3204,31 @@
     "description": "Dismissal of code scanning alerts was denied.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2103,19 +3239,31 @@
     "description": "Dismissal of code scanning alerts was requested.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2126,13 +3274,31 @@
     "description": "Code scanning alerts were seen for the first time.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "commit_oid",
-      "ref",
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
+      "commit_oid",
+      "ref",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2142,15 +3308,31 @@
     "description": "Code scanning alerts that were previously fixed reappeared.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2160,15 +3342,29 @@
     "description": "Code scanning alerts that were previously dismissed were reopened.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2178,14 +3374,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2195,25 +3406,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -2224,22 +3444,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -2251,22 +3482,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -2275,15 +3517,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -2294,17 +3551,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2314,27 +3584,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "owner",
-      "pull_request_id",
-      "machine_type",
-      "user_id",
-      "user",
-      "devcontainer_path",
-      "repo",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
+      "machine_type",
+      "devcontainer_path",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2342,19 +3621,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -2362,18 +3654,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -2382,23 +3686,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2406,16 +3717,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -2424,24 +3749,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2449,15 +3780,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2467,20 +3811,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2488,19 +3842,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -2508,21 +3874,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -2530,21 +3905,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "owner_type",
       "actor_id",
-      "user_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -2552,21 +3938,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "owner_type",
       "actor_id",
-      "user_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -2574,21 +3971,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2598,19 +4004,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2620,21 +4035,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2644,18 +4068,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -2668,18 +4105,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -2693,14 +4143,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -2713,8 +4178,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2723,27 +4187,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2752,19 +4224,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2773,16 +4257,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "definition_id"
@@ -2794,19 +4291,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -2815,19 +4323,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -2836,19 +4355,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -2857,19 +4387,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -2878,17 +4419,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2896,19 +4450,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -2917,19 +4482,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2937,40 +4513,62 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
-  },
-  {
-    "action": "dependabot_security_updates_new_repos.enable",
-    "description": "Dependabot security updates were enabled for all new repositories.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+  },
+  {
+    "action": "dependabot_security_updates_new_repos.enable",
+    "description": "Dependabot security updates were enabled for all new repositories.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2978,19 +4576,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -2999,19 +4608,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3019,19 +4639,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -3040,20 +4671,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3061,21 +4702,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "team",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "number",
-      "org",
-      "title",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id"
+      "team",
+      "created_at",
+      "number",
+      "title",
+      "operation_type"
     ]
   },
   {
@@ -3083,18 +4736,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user_id",
-      "actor",
       "number",
-      "user",
-      "created_at",
-      "request_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3102,18 +4768,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "_document_id",
-      "request_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "number",
       "team",
       "created_at"
@@ -3124,21 +4801,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "_document_id",
-      "title",
-      "user",
-      "user_agent",
-      "org",
-      "operation_type",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "team",
+      "_document_id",
       "action",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type",
+      "team",
       "number"
     ]
   },
@@ -3147,17 +4835,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3168,16 +4870,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3188,18 +4904,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
       "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3210,23 +4940,31 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise"
   },
@@ -3235,19 +4973,33 @@
     "description": "A domain was approved for an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3256,18 +5008,33 @@
     "description": "A domain was added to an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3276,18 +5043,33 @@
     "description": "A domain was removed from an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3296,18 +5078,33 @@
     "description": "A domain was verified for an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3316,18 +5113,30 @@
     "description": "A new GitHub Actions self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -3336,20 +5145,30 @@
     "description": "A GitHub Actions self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -3358,18 +5177,31 @@
     "description": "A GitHub Actions self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
@@ -3379,18 +5211,31 @@
     "description": "A GitHub Actions self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3399,20 +5244,33 @@
     "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -3421,19 +5279,31 @@
     "description": "A GitHub Actions self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3442,19 +5312,32 @@
     "description": "A GitHub Actions runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -3463,24 +5346,36 @@
     "description": "The configuration of a GitHub Actions self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3489,14 +5384,32 @@
     "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -3505,14 +5418,32 @@
     "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -3521,42 +5452,70 @@
     "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
-      "business_id",
-      "runner_id",
-      "runner_name",
-      "source_version",
-      "target_version",
-      "runner_group_id",
-      "runner_group_name",
-      "action",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "@timestamp"
-    ],
-    "docs_reference_titles": "Self-hosted runners"
-  },
-  {
-    "action": "enterprise_team.add_member",
-    "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.",
-    "docs_reference_links": "N/A",
-    "fields": [
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "runner_id",
+      "runner_name",
+      "source_version",
+      "target_version",
+      "runner_group_id",
+      "runner_group_name",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Self-hosted runners"
+  },
+  {
+    "action": "enterprise_team.add_member",
+    "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "user",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3564,21 +5523,33 @@
     "description": "A license for GitHub Copilot was assigned to an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3586,17 +5557,30 @@
     "description": "A license for GitHub Copilot was unassigned from an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3607,17 +5591,30 @@
     "description": "A new enterprise team was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3627,17 +5624,30 @@
     "description": "An enterprise team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3648,22 +5658,32 @@
     "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "business_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "user",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3671,18 +5691,31 @@
     "description": "The name of an enterprise team was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "business_id",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3693,22 +5726,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3717,22 +5759,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3740,28 +5792,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3770,27 +5828,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -3799,25 +5865,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3826,26 +5900,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3854,21 +5935,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -3877,22 +5970,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3901,25 +6004,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3928,22 +6040,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
-      "visibility",
-      "environment_name",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "visibility",
+      "environment_name",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -3952,21 +6076,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -3977,27 +6111,33 @@
     "description": "A user was added to an external group.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "external_group",
-      "external_group_id",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "external_group",
+      "external_group_id",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -4005,19 +6145,31 @@
     "description": "An external group was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at",
       "scim_group_id"
     ]
   },
@@ -4026,22 +6178,33 @@
     "description": "An external group was linked to a GitHub team.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "external_group",
-      "programmatic_access_type",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -4049,21 +6212,31 @@
     "description": "An external group was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4071,26 +6244,32 @@
     "description": "A user was removed from an external group.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "external_group",
-      "external_group_id",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "external_group",
+      "external_group_id",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4098,15 +6277,29 @@
     "description": "Failed external group SCIM API request.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
@@ -4114,15 +6307,9 @@
       "url_path",
       "scim_group_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4131,30 +6318,38 @@
     "description": "Successful external group SCIM API request. Excludes GET API requests.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4163,18 +6358,31 @@
     "description": "An external group was unlinked to a GitHub team.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "external_group"
     ]
   },
@@ -4183,22 +6391,32 @@
     "description": "An external group was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "scim_group_id",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at",
+      "scim_group_id"
     ]
   },
   {
@@ -4206,25 +6424,33 @@
     "description": "An external group's display name was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
       "external_group",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -4232,20 +6458,31 @@
     "description": "An external identity was deprovisioned, suspending the linked GitHub user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -4253,17 +6490,31 @@
     "description": "An external identity was created and linked to a GitHub user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "scim_user_id",
-      "request_access_security_header"
+      "scim_user_id"
     ]
   },
   {
@@ -4271,15 +6522,29 @@
     "description": "Failed external identity SCIM API request.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
@@ -4287,15 +6552,9 @@
       "url_path",
       "scim_user_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4304,30 +6563,38 @@
     "description": "Successful external identity SCIM API request. Excludes GET API requests.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4336,18 +6603,31 @@
     "description": "An external identity was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "scim_user_id",
-      "request_access_security_header"
+      "scim_user_id"
     ]
   },
   {
@@ -4355,42 +6635,65 @@
     "description": "A gist was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "user",
-      "gist_id",
       "@timestamp",
-      "created_at",
-      "operation_type",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "action",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "gist.destroy",
-    "description": "A gist was deleted.",
-    "docs_reference_links": "N/A",
-    "fields": [
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "gist_id",
-      "visibility",
       "created_at",
-      "_document_id",
-      "user",
-      "request_id",
       "operation_type",
+      "visibility"
+    ]
+  },
+  {
+    "action": "gist.destroy",
+    "description": "A gist was deleted.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "programmatic_access_type"
+      "gist_id",
+      "visibility",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4398,21 +6701,32 @@
     "description": "The visibility of a gist was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "user",
-      "gist_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "visibility",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "gist_id",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -4420,19 +6734,30 @@
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4441,20 +6766,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4463,19 +6798,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4484,22 +6830,33 @@
     "description": "An SSH key was added to a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -4508,23 +6865,34 @@
     "description": "An SSH key was removed from a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
       "explanation",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -4533,23 +6901,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4557,18 +6934,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4579,20 +6966,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -4602,18 +6999,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "user",
-      "operation_type",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4621,18 +7030,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4640,25 +7061,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -4666,25 +7097,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -4692,26 +7132,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -4720,25 +7169,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -4746,26 +7204,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -4773,21 +7240,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -4796,19 +7274,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -4816,21 +7307,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -4839,19 +7341,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -4862,20 +7378,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -4885,24 +7413,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -4913,23 +7452,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -4940,21 +7491,33 @@
     "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
       "operation_type",
-      "@timestamp",
       "integration",
-      "action",
-      "user_agent",
       "reason",
-      "_document_id",
-      "org",
-      "org_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -4965,20 +7528,32 @@
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
       "@timestamp",
-      "actor_id",
-      "org",
       "_document_id",
-      "requester",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "requester",
       "created_at",
       "url",
-      "org_id",
-      "request_id",
       "operation_type",
-      "actor",
       "integration",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -4988,20 +7563,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
-      "request_id",
-      "name",
-      "repository_selection",
-      "actor_id",
-      "integration",
-      "user",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "repository_selection",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -5011,19 +7599,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -5032,20 +7634,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -5055,20 +7670,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -5077,20 +7705,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -5099,20 +7740,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5120,19 +7773,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -5141,19 +7807,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -5162,17 +7841,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -5185,21 +7877,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
-      "user_id",
-      "name",
-      "transfer_to_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "transfer_to_id",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -5213,17 +7918,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -5235,19 +7953,30 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "user"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5255,19 +7984,30 @@
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5275,17 +8015,28 @@
     "description": "IP allow list user level enforcement was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5295,20 +8046,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "user_id",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
-      "_document_id",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "actor_id",
       "operation_type",
-      "org",
       "created_at"
     ]
   },
@@ -5317,19 +8077,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5337,17 +8108,28 @@
     "description": "IP allow list user level enforcement was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5357,24 +8139,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5382,24 +8172,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "ip_allow_list_entry",
-      "org",
-      "operation_type",
-      "created_at",
-      "active",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at",
+      "active"
     ]
   },
   {
@@ -5407,19 +8205,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "actor_id",
       "ip_allow_list_entry",
-      "active",
-      "org_id",
-      "@timestamp"
+      "active"
     ]
   },
   {
@@ -5427,18 +8238,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5446,21 +8269,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -5468,21 +8304,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5490,22 +8339,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -5513,19 +8375,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -5536,21 +8411,36 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
       "marketplace_listing",
       "has_free_trial",
-      "user_agent",
-      "request_id",
-      "actor_id",
       "yearly_price_in_cents",
       "description",
       "bullets",
       "monthly_price_in_cents",
-      "marketplace_listing_plan",
-      "_document_id"
+      "marketplace_listing_plan"
     ]
   },
   {
@@ -5558,22 +8448,37 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "marketplace_listing_plan",
       "marketplace_listing",
       "description",
       "bullets",
       "has_free_trial",
       "created_at",
-      "actor_id",
       "operation_type",
-      "_document_id",
-      "action",
-      "user_agent",
-      "request_id",
-      "actor",
       "monthly_price_in_cents",
-      "yearly_price_in_cents",
-      "@timestamp"
+      "yearly_price_in_cents"
     ]
   },
   {
@@ -5581,44 +8486,74 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "marketplace_listing_plan",
-      "_document_id",
-      "request_id",
-      "description",
-      "yearly_price_in_cents",
       "@timestamp",
-      "created_at",
-      "actor_id",
-      "bullets",
-      "has_free_trial",
-      "marketplace_listing",
-      "user_agent",
-      "monthly_price_in_cents",
+      "_document_id",
       "action",
-      "operation_type"
-    ]
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "marketplace_listing_plan",
+      "description",
+      "yearly_price_in_cents",
+      "created_at",
+      "bullets",
+      "has_free_trial",
+      "marketplace_listing",
+      "monthly_price_in_cents",
+      "operation_type"
+    ]
   },
   {
     "action": "marketplace_listing_plan.update",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "monthly_price_in_cents",
-      "marketplace_listing",
+      "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "monthly_price_in_cents",
+      "marketplace_listing",
       "description",
       "bullets",
       "yearly_price_in_cents",
-      "request_id",
-      "actor_id",
       "has_free_trial",
       "marketplace_listing_plan",
-      "user_agent",
-      "@timestamp",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -5627,22 +8562,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -5650,22 +8598,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5673,19 +8634,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5693,21 +8666,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5717,16 +8699,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5736,18 +8731,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5757,14 +8765,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5772,19 +8796,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5792,18 +8827,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5811,23 +8858,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -5835,20 +8890,30 @@
     "description": "An OAuth access token was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
     "fields": [
-      "_document_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "user",
-      "user_id",
-      "created_at",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "request_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
@@ -5859,19 +8924,30 @@
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "explanation",
-      "hashed_token",
-      "actor_id",
-      "token_scopes",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
@@ -5881,19 +8957,30 @@
     "description": "An OAuth access token was regenerated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "_document_id",
-      "created_at",
       "@timestamp",
-      "operation_type",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ]
   },
@@ -5902,16 +8989,28 @@
     "description": "An OAuth access token was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "request_access_security_header",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
       "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5921,18 +9020,30 @@
     "description": "An OAuth access token was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5940,20 +9051,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5962,20 +9085,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -5984,20 +9119,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6006,20 +9153,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6028,19 +9187,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6049,20 +9221,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6071,20 +9255,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6094,18 +9290,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "org_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "oauth_application_id",
-      "action",
       "created_at",
-      "actor",
-      "actor_id",
-      "oauth_application",
-      "_document_id",
-      "request_id"
+      "oauth_application"
     ]
   },
   {
@@ -6113,19 +9322,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6134,15 +9356,32 @@
     "description": "An OAuth application was unsuspended for a user or organization account.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "operation_type",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "oauth_application_id",
       "oauth_application",
-      "org",
-      "created_at",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6151,47 +9390,65 @@
     "description": "An authorization for an OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "user_id",
-      "actor",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
       "actor_id",
-      "user",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "oauth_application_name"
-    ],
-    "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
-  },
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "actor_is_bot",
+      "oauth_application_name"
+    ],
+    "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
+  },
   {
     "action": "oauth_authorization.destroy",
     "description": "An authorization for an OAuth application was deleted.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "actor",
       "created_at",
       "explanation",
-      "user",
-      "user_id",
-      "org_id",
-      "action",
-      "actor_id",
-      "token_scopes",
       "actor_is_bot",
       "oauth_application_name"
     ],
@@ -6202,20 +9459,31 @@
     "description": "An authorization for an OAuth application was updated.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
-      "actor_id",
       "user_agent",
-      "@timestamp",
       "operation_type",
-      "action",
-      "user",
       "created_at",
-      "_document_id",
       "actor_is_bot",
-      "request_access_security_header",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -6225,17 +9493,28 @@
     "description": "An invitation sent to an organization to join an enterprise was accepted.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6246,20 +9525,30 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
   },
@@ -6268,21 +9557,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -6291,24 +9590,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6316,21 +9625,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -6338,20 +9657,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6359,43 +9688,61 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "token_scopes"
-    ]
-  },
-  {
-    "action": "org.advanced_security_enabled_for_new_repos",
-    "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "org.advanced_security_enabled_for_new_repos",
+    "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6403,22 +9750,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6426,21 +9781,31 @@
     "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "new_policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -6450,19 +9815,30 @@
     "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -6471,19 +9847,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -6493,16 +9880,29 @@
     "description": "A user initiated a background job to delete an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ]
   },
@@ -6511,16 +9911,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -6529,18 +9942,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
-      "actor",
-      "user_agent",
-      "org_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "blocked_user",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -6549,19 +9975,30 @@
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -6571,22 +10008,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "org_id",
-      "request_id",
-      "email",
       "@timestamp",
-      "actor",
+      "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "email",
+      "operation_type",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -6594,19 +10042,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -6614,23 +10073,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6638,21 +10105,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6660,23 +10137,31 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6684,23 +10169,31 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6708,21 +10201,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -6731,21 +10233,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -6754,16 +10265,29 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
@@ -6773,17 +10297,30 @@
     "description": "The interaction limit for prior contributors only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6792,17 +10329,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6812,16 +10362,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6830,17 +10393,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6849,17 +10425,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6868,22 +10457,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -6892,17 +10489,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6913,18 +10521,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
-      "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -6933,18 +10553,30 @@
     "description": "An organization was deleted by a user or staff.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "org_id",
-      "org",
       "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6952,20 +10584,30 @@
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -6974,19 +10616,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -6995,14 +10648,31 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "sso_url",
-      "issuer",
-      "action",
       "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "issuer",
+      "created_at",
       "operation_type"
     ]
   },
@@ -7011,17 +10681,30 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7029,19 +10712,30 @@
     "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7049,19 +10743,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
-      "action",
-      "actor_id",
-      "org_id"
+      "created_at"
     ]
   },
   {
@@ -7069,19 +10774,30 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -7090,19 +10806,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -7111,19 +10838,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "sso_url",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "issuer",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "sso_url",
+      "created_at",
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -7132,17 +10872,30 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
   },
@@ -7151,17 +10904,30 @@
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -7170,42 +10936,64 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
-      "org",
-      "user_agent",
-      "request_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "manager",
-      "operation_type",
-      "created_at",
-      "_document_id"
-    ]
-  },
-  {
-    "action": "org.invite_member",
-    "description": "A new user was invited to join an organization.",
-    "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
-    "fields": [
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_id",
-      "invitation_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
+      "user_agent",
+      "manager",
       "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "org.invite_member",
+    "description": "A new user was invited to join an organization.",
+    "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -7214,17 +11002,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7234,19 +11033,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7254,19 +11064,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7275,16 +11096,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7292,17 +11126,30 @@
     "description": "An organization was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7310,19 +11157,31 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -7331,18 +11190,29 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
@@ -7352,21 +11222,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7374,21 +11253,30 @@
     "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user",
-      "org_id",
-      "created_at",
-      "request_id",
       "@timestamp",
-      "action",
-      "operation_type",
-      "user_agent",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7396,21 +11284,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -7418,18 +11316,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -7438,19 +11348,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
-      "old_login",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_login",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7458,20 +11380,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -7480,21 +11412,33 @@
     "description": "A self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -7504,21 +11448,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7527,23 +11481,33 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -7552,23 +11516,31 @@
     "description": "A self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7577,19 +11549,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -7598,25 +11583,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7625,21 +11621,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7649,21 +11654,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7673,20 +11687,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7695,22 +11719,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7719,21 +11751,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7742,21 +11783,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7765,22 +11815,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7789,21 +11847,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7812,21 +11879,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7836,21 +11912,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7860,19 +11945,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7882,21 +11978,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7906,21 +12011,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7930,19 +12044,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7952,22 +12077,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7976,22 +12109,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8000,22 +12141,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8024,21 +12173,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8047,21 +12205,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8070,22 +12237,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8094,22 +12269,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8118,26 +12301,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8146,26 +12338,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8173,28 +12373,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8202,26 +12410,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8229,15 +12445,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -8246,26 +12479,64 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
-      "org",
-      "runner_id",
-      "runner_name",
-      "action",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "@timestamp"
-    ],
-    "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
-  },
-  {
-    "action": "org.self_hosted_runner_updated",
-    "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
-    "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
-    "fields": [
-      "org_id",
-      "runner_id",
-      "runner_name",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_id",
+      "runner_name",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
+  },
+  {
+    "action": "org.self_hosted_runner_updated",
+    "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
+    "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_id",
+      "runner_name",
       "source_version",
       "target_version",
       "runner_group_id",
@@ -8278,20 +12549,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -8300,16 +12582,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -8320,18 +12615,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -8340,17 +12648,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8358,18 +12679,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -8378,18 +12711,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -8398,18 +12744,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -8418,42 +12776,64 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
-      "org",
-      "issuer",
       "business",
-      "operation_type",
-      "created_at",
-      "request_id",
       "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "org.transform",
-    "description": "A user account was converted into an organization.",
-    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization",
-    "fields": [
-      "actor",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "issuer",
       "operation_type",
+      "created_at",
+      "actor_is_bot"
+    ]
+  },
+  {
+    "action": "org.transform",
+    "description": "A user account was converted into an organization.",
+    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "@timestamp",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "owner",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "owner"
     ],
     "docs_reference_titles": "Converting a user into an organization"
   },
@@ -8462,19 +12842,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
-      "oauth_application_id",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "blocked_user",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -8483,23 +12876,34 @@
     "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -8508,20 +12912,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -8530,20 +12946,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -8551,17 +12978,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -8571,20 +13011,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -8593,19 +13044,32 @@
     "description": "An organization's SAML provider settings were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "issuer",
-      "org",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -8613,19 +13077,31 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "operation_type",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
-    ],
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
   {
@@ -8633,20 +13109,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "org_id",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -8655,16 +13144,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8673,14 +13177,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -8691,16 +13210,31 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "operation_type",
-      "domain_name",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
       "_document_id",
-      "actor_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "domain_name",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8709,20 +13243,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -8732,23 +13277,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8757,21 +13313,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -8782,21 +13349,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8805,20 +13385,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8827,17 +13421,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
-      "owner_type",
-      "domain",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
+      "owner_type",
+      "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8848,20 +13457,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8870,19 +13493,31 @@
     "description": "A new passkey was added.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8890,19 +13525,31 @@
     "description": "A new passkey was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8910,18 +13557,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8929,16 +13588,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8946,18 +13619,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8965,18 +13650,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8987,22 +13685,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9010,22 +13717,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9033,18 +13749,28 @@
     "description": "The configured restriction for access to resources via personal access tokens was reset and delegated to organizations.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9055,18 +13781,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9077,18 +13816,28 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9099,18 +13848,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9121,18 +13880,28 @@
     "description": "Triggered when the enterprise delegates to the organizations when to require approval for fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9143,17 +13912,30 @@
     "description": "Triggered when you create a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9163,19 +13945,31 @@
     "description": "Triggered when you regenerate a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9183,12 +13977,29 @@
     "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
     "fields": [
-      "user_programmatic_access_name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
       "operation_type"
     ],
@@ -9199,20 +14010,32 @@
     "description": "Triggered when you delete a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "explanation",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9220,23 +14043,34 @@
     "description": "A personal access token expiration limit was set.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "token_expiration",
       "old_token_expiration",
       "exempt_administrators",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9244,21 +14078,32 @@
     "description": "A personal access token expiration limit was unset.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "programmatic_access_type",
-      "old_token_expiration",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_token_expiration",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9266,17 +14111,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9287,18 +14145,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9310,17 +14181,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9332,17 +14216,30 @@
     "description": "A fine-grained personal access token was updated.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9353,15 +14250,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9371,17 +14283,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9391,15 +14314,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9409,17 +14347,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9429,17 +14378,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9449,17 +14409,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9469,17 +14440,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9489,17 +14471,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -9509,17 +14504,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9527,20 +14535,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -9550,25 +14569,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -9576,20 +14607,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9597,25 +14640,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9623,17 +14678,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9641,17 +14709,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9659,18 +14740,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -9679,18 +14772,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -9699,19 +14804,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -9719,17 +14835,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -9741,22 +14870,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -9764,19 +14902,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9784,17 +14933,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9802,18 +14964,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -9821,20 +14996,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9842,18 +15027,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -9862,18 +15059,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -9882,16 +15091,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -9903,21 +15125,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -9925,22 +15159,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -9949,29 +15193,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9979,24 +15228,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "repo_id",
-      "user_id",
       "@timestamp",
-      "user_agent",
-      "repo",
-      "name",
-      "org_id",
-      "user",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -10007,21 +15264,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -10032,22 +15299,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10055,24 +15332,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "authorized_actors_only",
       "authorized_actors",
       "created_at",
-      "user_agent",
       "name",
-      "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
-      "actor_id",
-      "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -10080,30 +15367,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -10113,28 +15407,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -10145,23 +15447,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -10169,22 +15480,32 @@
     "description": "Branch deletion was enabled or disabled for a protected branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "operation_type",
-      "request_id",
-      "repo",
       "@timestamp",
-      "org_id",
-      "org",
-      "action",
-      "allow_deletions_enforcement_level",
       "_document_id",
-      "created_at",
-      "actor_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_deletions_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10192,23 +15513,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "actor_id",
-      "name",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo",
-      "operation_type",
-      "request_id",
-      "allow_force_pushes_enforcement_level",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_force_pushes_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10216,24 +15546,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -10242,22 +15581,32 @@
     "description": "Required linear commit history was enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "operation_type",
       "actor",
-      "linear_history_requirement_enforcement_level",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "linear_history_requirement_enforcement_level",
       "name",
-      "org_id",
-      "repo_id",
-      "org",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -10265,24 +15614,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "lock_allows_fetch_and_merge",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "lock_allows_fetch_and_merge",
+      "public_repo",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10291,27 +15649,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10320,18 +15685,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -10342,24 +15720,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -10367,25 +15754,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -10393,22 +15787,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -10416,22 +15820,33 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
   },
@@ -10440,22 +15855,32 @@
     "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "required_approving_review_count",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10463,48 +15888,65 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "protected_branch.update_signature_requirement_enforcement_level",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
+    ]
+  },
+  {
+    "action": "protected_branch.update_signature_requirement_enforcement_level",
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
       "action",
       "actor",
       "actor_id",
-      "signature_requirement_enforcement_level",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "programmatic_access_type"
+      "operation_type",
+      "name",
+      "created_at",
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -10512,22 +15954,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "created_at",
-      "repo_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "name",
-      "actor",
-      "repo",
       "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
+      "strict_required_status_checks_policy"
     ]
   },
   {
@@ -10535,23 +15987,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -10560,24 +16023,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -10586,20 +16060,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10608,21 +16096,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -10632,22 +16133,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10656,25 +16169,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10683,23 +16206,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
-      "created_at",
-      "key",
-      "fingerprint",
-      "actor_id",
       "actor",
-      "title",
-      "user_agent",
-      "user_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "read_only",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "key",
+      "fingerprint",
+      "title",
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10708,18 +16242,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -10729,21 +16277,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -10752,19 +16311,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -10775,23 +16347,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -10801,17 +16385,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -10819,19 +16417,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -10839,19 +16450,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -10861,21 +16485,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -10884,27 +16519,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
-      "pull_request_url",
-      "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
+      "pull_request_url",
+      "pull_request_title",
+      "public_repo",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -10912,23 +16554,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -10937,18 +16591,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -10956,19 +16624,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -10978,20 +16658,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
-      "repo",
-      "created_at",
-      "request_id",
-      "comment_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "comment_id",
+      "operation_type"
     ]
   },
   {
@@ -10999,18 +16690,31 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "_document_id",
-      "@timestamp",
-      "comment_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "comment_id"
     ]
   },
   {
@@ -11018,21 +16722,33 @@
     "description": "A review on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -11040,20 +16756,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -11062,19 +16791,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -11084,23 +16827,33 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "created_at",
-      "user_agent",
-      "actor",
-      "action",
-      "repo",
-      "visibility",
       "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
-    ],
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility",
+      "previous_visibility"
+    ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
   {
@@ -11108,21 +16861,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -11131,25 +16893,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -11158,23 +16927,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -11183,24 +16960,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -11209,23 +16993,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -11235,22 +17027,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -11259,19 +17060,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11280,24 +17094,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -11306,24 +17130,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11331,24 +17163,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11356,24 +17196,32 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11381,24 +17229,32 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11406,23 +17262,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11433,17 +17298,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -11453,17 +17330,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -11473,25 +17362,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11500,26 +17395,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11528,25 +17431,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "query_suite",
-      "threat_model",
-      "languages",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "query_suite",
+      "threat_model",
+      "languages",
+      "public_repo",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -11556,20 +17468,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "visibility",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11577,17 +17500,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11596,15 +17532,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -11615,16 +17564,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11634,17 +17596,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11654,19 +17629,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11675,17 +17661,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11694,26 +17693,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -11722,30 +17727,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
-      "repo",
-      "user_id",
-      "visibility",
-      "repo_id",
-      "user",
-      "request_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_category",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "org",
-      "oauth_application_id",
-      "org_id",
-      "request_method",
+      "actor_id",
       "business",
       "business_id",
-      "public_repo",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "request_category",
+      "created_at",
+      "oauth_application_id",
+      "request_method",
+      "public_repo",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -11755,20 +17765,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -11777,25 +17798,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -11804,23 +17833,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11828,25 +17868,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -11856,17 +17905,30 @@
     "description": "A repository was archived on disk.",
     "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
-      "repo_id",
-      "actor",
       "action",
-      "user_agent"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository/archiving-repositories"
   },
@@ -11875,23 +17937,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -11901,62 +17972,95 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "visibility",
-      "repo_id",
-      "created_at",
-      "actor",
-      "action",
-      "@timestamp",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id"
-    ]
-  },
-  {
-    "action": "repo.noindex",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "visibility",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "actor_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "actor",
-      "user_agent",
-      "repo",
       "user_id",
-      "public_repo"
+      "user_agent",
+      "operation_type",
+      "visibility",
+      "created_at"
     ]
   },
   {
-    "action": "repo.override_unlock",
-    "description": "The repository was unlocked.",
+    "action": "repo.noindex",
+    "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
       "operation_type",
+      "public_repo"
+    ]
+  },
+  {
+    "action": "repo.override_unlock",
+    "description": "The repository was unlocked.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "created_at",
-      "_document_id"
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11964,20 +18068,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "action",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "operation_type",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "visibility",
-      "actor",
-      "user_id"
+      "visibility"
     ]
   },
   {
@@ -11985,23 +18100,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -12009,21 +18134,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12031,21 +18166,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -12053,22 +18198,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -12076,21 +18230,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -12098,20 +18262,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -12119,22 +18294,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12142,18 +18326,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -12161,22 +18359,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -12184,21 +18392,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12206,18 +18424,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -12226,22 +18456,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12250,24 +18489,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12276,23 +18523,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12300,26 +18557,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -12328,21 +18590,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -12351,25 +18622,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12377,22 +18654,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -12401,20 +18688,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "visibility",
-      "operation_type",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "@timestamp",
-      "request_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -12422,19 +18720,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12442,17 +18751,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12461,17 +18785,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12480,7 +18819,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -12495,46 +18855,66 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "public_repo"
-    ],
-    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
-  },
-  {
-    "action": "repo.set_actions_private_fork_pr_approvals_policy",
-    "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
-    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
+      "created_at",
+      "operation_type",
+      "public_repo"
+    ],
+    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
+  },
+  {
+    "action": "repo.set_actions_private_fork_pr_approvals_policy",
+    "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
+    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -12545,21 +18925,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -12568,22 +18959,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -12592,21 +18993,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -12615,22 +19027,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -12641,16 +19063,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -12659,22 +19092,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -12684,22 +19126,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -12708,23 +19161,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12734,19 +19197,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -12754,21 +19227,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -12777,24 +19260,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -12802,25 +19294,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12829,24 +19328,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12855,25 +19364,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12882,22 +19399,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12906,26 +19432,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12933,31 +19467,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "created_at",
-      "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
-      "operation_type",
-      "request_id",
-      "org_id",
       "actor_id",
-      "visibility",
-      "old_permission",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "visibility",
+      "old_permission",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12966,24 +19507,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -12992,24 +19539,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -13018,21 +19571,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -13040,21 +19603,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13062,21 +19635,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -13084,20 +19668,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -13105,21 +19701,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13127,19 +19734,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -13147,31 +19767,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -13180,19 +19808,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -13200,8 +19839,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -13210,23 +19848,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -13251,26 +19898,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -13279,26 +19932,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -13307,23 +19966,30 @@
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13333,23 +19999,30 @@
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13359,24 +20032,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13386,24 +20066,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -13412,24 +20099,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13439,23 +20133,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13465,23 +20166,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13490,22 +20199,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13513,24 +20230,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -13539,24 +20264,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -13565,19 +20298,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13586,24 +20331,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13612,24 +20365,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13638,19 +20399,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13659,26 +20432,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13687,26 +20465,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13715,28 +20498,36 @@
     "description": "A code security configuration was applied to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13744,27 +20535,35 @@
     "description": "A code security configuration failed to attach to the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13772,28 +20571,36 @@
     "description": "A code security configuration was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13801,28 +20608,36 @@
     "description": "A code security configuration was removed due to a change in repository or enterprise settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13830,29 +20645,37 @@
     "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -13861,29 +20684,37 @@
     "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "alert_id",
-      "alert_number",
-      "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "alert_number",
+      "ghsa_id",
+      "public_repo",
+      "owner",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -13892,19 +20723,32 @@
     "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
-      "operation_type",
-      "request_id",
-      "repo_id",
       "@timestamp",
-      "user_agent",
-      "alert_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "alert_id",
+      "created_at",
+      "alert_number"
     ],
     "docs_reference_titles": "About Dependabot alerts"
   },
@@ -13913,23 +20757,32 @@
     "description": "A Dependabot alert was manually dismissed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "alert_id",
-      "actor",
-      "repo",
       "created_at",
-      "org",
-      "_document_id",
-      "action",
-      "actor_id",
       "dismiss_reason",
-      "user",
       "dismiss_comment",
       "alert_number",
       "actor_is_bot"
@@ -13940,21 +20793,33 @@
     "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "public_repo",
       "owner",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "token_scopes",
       "alert_number"
     ]
   },
@@ -13963,26 +20828,34 @@
     "description": "A Dependabot alert was manually reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo",
-      "alert_number",
-      "request_access_security_header"
+      "alert_number"
     ]
   },
   {
@@ -13990,21 +20863,32 @@
     "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "alert_id",
-      "repo",
-      "operation_type",
-      "action",
-      "repo_id",
-      "_document_id",
-      "user_agent",
-      "request_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "operation_type",
+      "created_at",
+      "alert_number"
     ]
   },
   {
@@ -14012,21 +20896,35 @@
     "description": "A Dependabot alert was withdrawn.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
       "created_at",
       "active",
-      "action",
-      "repository_id",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type"
     ]
   },
@@ -14035,20 +20933,30 @@
     "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
     "fields": [
-      "org",
+      "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
-      "operation_type",
-      "created_at",
-      "actor",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
   },
@@ -14057,24 +20965,31 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -14082,26 +20997,32 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14109,23 +21030,30 @@
     "description": "Dependabot alerts was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "request_id",
-      "repo_id",
-      "action",
-      "actor_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "_document_id",
       "user_id",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14133,23 +21061,30 @@
     "description": "Dependabot alerts was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_agent",
-      "created_at",
       "@timestamp",
-      "repo_id",
+      "_document_id",
       "action",
-      "user",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor_id",
-      "_document_id",
-      "user_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -14158,18 +21093,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -14178,19 +21126,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -14199,14 +21159,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -14220,22 +21194,32 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
@@ -14244,28 +21228,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -14273,25 +21266,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -14299,14 +21299,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -14323,19 +21337,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14344,19 +21369,30 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14365,20 +21401,30 @@
     "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14387,19 +21433,30 @@
     "description": "Secret scanning was enabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14408,14 +21465,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -14433,25 +21504,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14460,25 +21539,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -14488,25 +21575,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -14515,22 +21610,35 @@
     "description": "A secret scanning scan has completed on this repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "repo_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "source",
       "type",
       "source_slug",
       "type_slug",
       "started_at",
       "completed_at",
-      "repo",
       "public_repo",
-      "org",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "secret_types",
@@ -14544,10 +21652,28 @@
     "description": "A security configuration was created",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -14562,15 +21688,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14588,22 +21707,33 @@
     "description": "A default security configuration setting for new repositories was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14612,22 +21742,33 @@
     "description": "A default security configuration setting for new repositories was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14636,10 +21777,28 @@
     "description": "A security configuration was deleted",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -14654,15 +21813,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14679,15 +21831,30 @@
     "description": "A security configuration policy was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enforcement",
       "security_configuration_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14697,10 +21864,28 @@
     "description": "A security configuration was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -14715,15 +21900,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14741,18 +21919,30 @@
     "description": "A security key was registered for an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14760,18 +21950,30 @@
     "description": "A security key was removed from an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14779,17 +21981,30 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sponsors_listing_id",
+      "created_at",
       "operation_type"
     ]
   },
@@ -14798,18 +22013,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -14818,16 +22046,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14838,15 +22079,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -14856,15 +22110,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -14873,17 +22142,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -14892,17 +22174,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -14911,16 +22207,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -14930,14 +22239,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -14947,17 +22271,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -14966,37 +22303,63 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
-      "user_agent",
-      "actor"
-    ],
-    "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
-  },
-  {
-    "action": "sponsors.sponsored_developer_disable",
-    "description": "A GitHub Sponsors account was disabled.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
+  },
+  {
+    "action": "sponsors.sponsored_developer_disable",
+    "description": "A GitHub Sponsors account was disabled.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15005,15 +22368,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -15023,16 +22400,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15040,15 +22430,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -15059,16 +22462,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -15078,17 +22494,30 @@
     "description": "Triggered when you send an email update to your sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
     "fields": [
-      "request_id",
-      "actor",
-      "action",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
   },
@@ -15097,17 +22526,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -15118,17 +22560,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -15139,18 +22594,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15160,16 +22626,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15179,17 +22658,30 @@
     "description": "You join the waitlist to join GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "actor_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -15198,16 +22690,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15219,17 +22724,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15238,19 +22756,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15259,21 +22790,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "user",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
       "action",
-      "user_id",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "actor_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15282,19 +22822,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15303,20 +22854,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15324,18 +22889,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -15343,40 +22923,65 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "domain_name",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ]
-  },
-  {
-    "action": "sub_issues.parent_issue_add",
-    "description": "A parent issue was added to an issue.",
-    "docs_reference_links": "N/A",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "sub_issues.parent_issue_add",
+    "description": "A parent issue was added to an issue.",
+    "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15384,23 +22989,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15408,23 +23023,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15432,23 +23057,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15456,15 +23091,30 @@
     "description": "Triggered when you accept a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -15473,15 +23123,30 @@
     "description": "Triggered when you cancel a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -15490,15 +23155,30 @@
     "description": "Triggered when you create a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -15507,15 +23187,30 @@
     "description": "Triggered when you decline a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -15524,31 +23219,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ]
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "successor_invitation.revoke",
     "description": "Triggered when you revoke a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -15557,21 +23282,31 @@
     "description": "A member of an organization was added to a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
-      "user",
       "@timestamp",
-      "actor_id",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "org",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -15581,22 +23316,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -15605,20 +23349,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -15627,18 +23382,31 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
       "created_at",
       "operation_type",
-      "actor_id",
-      "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
@@ -15648,21 +23416,32 @@
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -15671,21 +23450,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -15694,19 +23483,31 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "team",
       "org_id",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
       "operation_type",
-      "_document_id",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -15715,19 +23516,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
       "business",
-      "action",
-      "request_id",
-      "created_at",
-      "user_id",
-      "_document_id"
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15735,19 +23547,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "request_id",
       "actor",
-      "org",
-      "created_at",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15755,18 +23578,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
       "@timestamp",
-      "action",
       "_document_id",
-      "user_agent",
-      "user_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -15775,22 +23609,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -15799,22 +23642,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -15824,21 +23676,31 @@
     "description": "A repository was removed from a team's control.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "org",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -15846,21 +23708,32 @@
     "description": "A team's name was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "user_agent",
-      "created_at",
-      "team",
-      "operation_type",
-      "actor_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -15869,17 +23742,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -15888,19 +23774,30 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -15909,46 +23806,68 @@
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "permission",
-      "new_repo_permission",
-      "new_repo_base_role",
-      "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "trusted_device.register",
-    "description": "A new trusted device was added.",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
+      "operation_type",
+      "created_at",
+      "permission",
+      "new_repo_permission",
+      "new_repo_base_role",
+      "old_repo_permission",
+      "old_repo_base_role"
+    ]
+  },
+  {
+    "action": "trusted_device.register",
+    "description": "A new trusted device was added.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15956,17 +23875,30 @@
     "description": "A trusted device was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15974,14 +23906,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "action",
-      "request_id",
-      "user_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -15990,15 +23937,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "created_at",
-      "user_id",
-      "operation_type",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16006,13 +23968,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "created_at",
-      "user_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16020,17 +23999,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "operation_type",
-      "action",
-      "_document_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16038,17 +24030,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16056,16 +24061,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16073,54 +24092,93 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "user",
       "_document_id",
-      "request_id"
-    ]
-  },
-  {
-    "action": "two_factor_authentication.add_factor",
-    "description": "A secondary authentication factor was added to a user account.",
-    "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
-    "fields": [
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "two_factor_authentication.add_factor",
+    "description": "A secondary authentication factor was added to a user account.",
+    "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
   {
     "action": "two_factor_authentication.disabled",
     "description": "Two-factor authentication was disabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
     "fields": [
-      "actor",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_id",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Disabling two-factor authentication for your personal account"
   },
@@ -16129,18 +24187,30 @@
     "description": "Two-factor authentication was enabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
-      "actor",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Configuring two-factor authentication"
   },
@@ -16149,15 +24219,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user",
-      "user_id",
-      "action",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "user_agent"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16165,16 +24250,29 @@
     "description": "Two factor recovery codes were regenerated for a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
+      "operation_type",
       "created_at"
     ]
   },
@@ -16183,18 +24281,30 @@
     "description": "A secondary authentication factor was removed from a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -16203,15 +24313,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "created_at",
-      "_document_id",
-      "action",
-      "@timestamp"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16220,16 +24345,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "operation_type",
       "user_agent",
-      "action",
-      "request_id",
-      "actor",
-      "actor_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16237,19 +24375,31 @@
     "description": "An email address was added to a user account.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "actor_id",
-      "actor",
       "email",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding an email address to your GitHub account"
   },
@@ -16258,18 +24408,30 @@
     "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
-      "created_at",
-      "user",
-      "@timestamp",
-      "_document_id",
-      "request_id",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16277,15 +24439,28 @@
     "description": "Audit log entries were exported.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "action",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ]
@@ -16295,20 +24470,31 @@
     "description": "A user was blocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_id",
-      "_document_id",
       "actor_id",
-      "@timestamp",
-      "user_agent",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -16316,18 +24502,30 @@
     "description": "A user changed their password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "actor_id",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16335,18 +24533,30 @@
     "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -16355,17 +24565,30 @@
     "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -16374,16 +24597,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
-      "user",
       "action",
-      "operation_type",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16391,16 +24628,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "_document_id",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16408,16 +24659,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user_id",
       "@timestamp",
-      "user",
+      "_document_id",
       "action",
-      "request_access_security_header"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16425,41 +24690,65 @@
     "description": "A new user account was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "email",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "created_at",
       "_document_id",
-      "user_agent",
-      "actor",
-      "actor_id",
       "action",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "user.create_integration_secret",
-    "description": "A user secret for Codespaces was created.",
-    "docs_reference_links": "N/A",
-    "fields": [
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
-      "visibility",
-      "integration",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
+      "user_agent",
+      "email",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "user.create_integration_secret",
+    "description": "A user secret for Codespaces was created.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "visibility",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -16467,20 +24756,31 @@
     "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "oauth_application_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "@timestamp",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -16488,18 +24788,30 @@
     "description": "A user account was destroyed by an asynchronous job.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16508,19 +24820,30 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "oauth_application_id",
+      "_document_id",
       "action",
-      "user",
-      "created_at",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16528,18 +24851,30 @@
     "description": "A user deleted his or her account, triggering user.async_delete.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
-      "created_at",
-      "user_agent",
       "user_id",
-      "operation_type",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16547,18 +24882,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "user_agent",
       "user_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16566,18 +24913,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "_document_id",
-      "@timestamp",
-      "user",
-      "actor_id",
-      "action",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -16586,17 +24945,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "request_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16604,35 +24975,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ]
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "user.disable_contributors_only",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16640,17 +25037,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16658,21 +25068,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16680,21 +25100,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -16703,17 +25133,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16721,17 +25164,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16739,17 +25195,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16757,18 +25226,30 @@
     "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "org_id",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16776,16 +25257,29 @@
     "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ]
   },
@@ -16794,36 +25288,63 @@
     "description": "A user requested a password reset.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
     "fields": [
-      "action",
-      "_document_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
       "@timestamp",
-      "email",
-      "created_at",
-      "user_id",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
-  },
-  {
-    "action": "user.grant_github_developer",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "email",
+      "created_at"
+    ],
+    "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
+  },
+  {
+    "action": "user.grant_github_developer",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "request_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16831,18 +25352,30 @@
     "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -16851,19 +25384,31 @@
     "description": "A user signed in.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "actor_id",
       "@timestamp",
-      "user",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "actor",
-      "passkey_nickname",
-      "request_access_security_header"
+      "passkey_nickname"
     ]
   },
   {
@@ -16871,18 +25416,30 @@
     "description": "A user signed out.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -16890,19 +25447,30 @@
     "description": "A comment made by a user was minimized.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
-      "actor_id",
       "@timestamp",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "user",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16910,18 +25478,30 @@
     "description": "A user signed in from a new device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16929,14 +25509,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16944,60 +25540,94 @@
     "description": "An ordinary user account was promoted to a site administrator.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "user.recreate",
-    "description": "A user's account was restored.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
       "user",
-      "action",
-      "actor_id",
-      "@timestamp",
-      "_document_id",
-      "request_id",
       "user_id",
+      "user_agent",
       "created_at",
-      "actor",
+      "oauth_application_id",
       "operation_type"
     ]
   },
   {
-    "action": "user.remove_email",
-    "description": "An email address was removed from a user account.",
+    "action": "user.recreate",
+    "description": "A user's account was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "operation_type",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "user.remove_email",
+    "description": "An email address was removed from a user account.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "email",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "email"
     ]
   },
   {
@@ -17005,20 +25635,32 @@
     "description": "A user secret for Codespaces was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "key",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17026,17 +25668,30 @@
     "description": "A user account was no longer flagged as a large scale contributor.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -17044,20 +25699,31 @@
     "description": "A username was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "request_id",
-      "actor_id",
-      "old_login",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_login",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17065,17 +25731,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "user_agent",
-      "request_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -17084,18 +25762,30 @@
     "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "action",
       "created_at",
-      "actor",
-      "operation_type",
-      "actor_id",
-      "user_id",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam"
   },
@@ -17104,18 +25794,30 @@
     "description": "A user reset their account password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17123,16 +25825,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -17143,16 +25858,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -17161,18 +25888,30 @@
     "description": "A user signed in from an unrecognized device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor",
-      "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -17180,18 +25919,30 @@
     "description": "A user signed in from an unrecognized device and location.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "created_at",
-      "_document_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17199,18 +25950,30 @@
     "description": "A user signed in from an unrecognized location.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "action",
-      "operation_type",
-      "user_agent",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
       "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17218,22 +25981,33 @@
     "description": "Triggered when you clear the status on your profile.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "message",
-      "user",
-      "actor_id",
       "created_at",
-      "request_id",
       "limited_availability",
-      "action",
       "emoji",
-      "operation_type",
-      "user_agent",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17241,23 +26015,33 @@
     "description": "Triggered when you set or change the status on your profile.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
     "fields": [
-      "limited_availability",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "message",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "limited_availability",
+      "message",
+      "created_at",
       "emoji",
-      "org",
-      "actor",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
   },
@@ -17266,21 +26050,31 @@
     "description": "A user account was suspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "user_agent",
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "token_scopes",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17288,18 +26082,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
-      "actor_id",
       "@timestamp",
-      "operation_type",
       "_document_id",
-      "user_agent",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17307,18 +26113,30 @@
     "description": "A 2FA challenge issued for a user account failed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "actor_id",
-      "actor",
-      "user_id",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17328,16 +26146,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
       "user_agent",
-      "request_id",
-      "action",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17345,18 +26175,30 @@
     "description": "A user used their 2FA recovery codes.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17364,18 +26206,30 @@
     "description": "A user downloaded 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17383,17 +26237,30 @@
     "description": "A user printed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17401,18 +26268,30 @@
     "description": "A user viewed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_agent",
-      "actor",
-      "user_id",
-      "action",
-      "created_at",
-      "user",
-      "operation_type",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "request_access_security_header"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17420,17 +26299,30 @@
     "description": "A user was prompted for a two-factor authentication code.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
     "fields": [
-      "user",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "actor"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
   },
@@ -17439,19 +26331,31 @@
     "description": "A user was unblocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "user_agent",
-      "user_id",
-      "user",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -17460,15 +26364,28 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user_agent",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "request_id",
-      "actor",
-      "action",
       "created_at"
     ]
   },
@@ -17477,21 +26394,31 @@
     "description": "A user account was unsuspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "user_agent",
       "actor",
-      "oauth_application_id",
-      "operation_type",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "user_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17499,21 +26426,33 @@
     "description": "A user secret for Codespaces was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17521,18 +26460,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17540,16 +26491,30 @@
     "description": "A Dependabot rule was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17559,16 +26524,30 @@
     "description": "A Dependabot rule was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17578,18 +26557,31 @@
     "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17599,21 +26591,33 @@
     "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17621,21 +26625,32 @@
     "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -17643,21 +26658,32 @@
     "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -17665,16 +26691,30 @@
     "description": "A Dependabot rule's conditions, actions, or metadata changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17684,27 +26724,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -17713,23 +26759,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17737,10 +26793,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17751,20 +26825,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -17773,23 +26836,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17799,10 +26870,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17814,19 +26903,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -17837,10 +26916,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17849,21 +26946,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -17873,23 +26959,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -17898,22 +26996,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -17921,21 +27030,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -17943,25 +27063,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -17969,23 +27097,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -17999,24 +27140,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -18025,10 +27175,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -18038,21 +27206,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -18062,25 +27220,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.17/organization.json b/src/audit-logs/data/ghes-3.17/organization.json
index 57fcd02eb76e..579c2327cfb1 100644
--- a/src/audit-logs/data/ghes-3.17/organization.json
+++ b/src/audit-logs/data/ghes-3.17/organization.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,29 +67,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -72,21 +103,32 @@
     "description": "Credit was accepted for a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Editing a repository security advisory"
   },
@@ -95,21 +137,32 @@
     "description": "Someone was added to the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -117,21 +170,32 @@
     "description": "Credit was declined for a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -140,21 +204,32 @@
     "description": "Someone was removed from the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -163,18 +238,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -182,17 +269,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -203,39 +301,62 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
+  },
   {
     "action": "billing.change_billing_type",
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -244,19 +365,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -265,18 +398,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -284,18 +430,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -303,20 +461,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -325,20 +494,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -349,17 +529,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -367,15 +559,31 @@
     "description": "Existing code scanning alerts appeared in a branch.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -385,15 +593,31 @@
     "description": "Code scanning alerts were fixed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -403,15 +627,31 @@
     "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_numbers",
-      "commit_oid",
-      "ref",
-      "request_id",
-      "org_id",
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
-      "business"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_numbers",
+      "commit_oid",
+      "ref"
     ],
     "docs_reference_titles": "About code scanning"
   },
@@ -420,15 +660,29 @@
     "description": "Code scanning alerts were manually dismissed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers",
       "dismissal_approver_id"
     ],
@@ -439,19 +693,31 @@
     "description": "Dismissal of code scanning alerts was approved.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -462,19 +728,31 @@
     "description": "Dismissal of code scanning alerts was denied.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -485,19 +763,31 @@
     "description": "Dismissal of code scanning alerts was requested.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -508,13 +798,31 @@
     "description": "Code scanning alerts were seen for the first time.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -524,15 +832,31 @@
     "description": "Code scanning alerts that were previously fixed reappeared.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -542,15 +866,29 @@
     "description": "Code scanning alerts that were previously dismissed were reopened.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -560,14 +898,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -577,28 +930,34 @@
     "description": "An attempt to create a codespace from a prebuild was made.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "owner",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "user_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
       "created_at",
       "operation_type",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -606,17 +965,30 @@
     "description": "Enterprise setting for Codespaces ownership was updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enablement",
       "organization_names",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -627,25 +999,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -656,22 +1037,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -683,22 +1075,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -707,15 +1110,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -726,15 +1144,28 @@
     "description": "Policies were applied to codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -744,20 +1175,30 @@
     "description": "Policies were removed from codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -765,19 +1206,30 @@
     "description": "Policies were updated for codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -785,17 +1237,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -805,27 +1270,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -833,19 +1307,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -853,18 +1340,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -873,20 +1372,30 @@
     "description": "A commit comment was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "created_at",
-      "@timestamp",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "programmatic_access_type"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -894,21 +1403,30 @@
     "description": "A commit comment was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_id",
-      "action",
-      "@timestamp",
-      "repo",
       "org_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -916,21 +1434,33 @@
     "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "reason",
       "plan",
-      "org_id",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -938,13 +1468,28 @@
     "description": "Copilot feature settings were changed at the organization level.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -954,23 +1499,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -978,16 +1530,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -996,40 +1562,59 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "copilot.cfb_seat_assignment_reused",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "copilot.cfb_seat_assignment_reused",
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1039,20 +1624,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1060,19 +1655,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -1080,21 +1687,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1102,21 +1718,33 @@
     "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_value",
       "new_value",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1124,21 +1752,32 @@
     "description": "The excluded paths for GitHub Copilot were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "excluded_paths",
       "owner_type",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1146,14 +1785,28 @@
     "description": "Copilot custom instructions were created for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "custom_instructions"
@@ -1164,14 +1817,28 @@
     "description": "Copilot custom instructions were updated for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "custom_instructions"
@@ -1182,21 +1849,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1204,21 +1881,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1226,21 +1913,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1248,17 +1945,30 @@
     "description": "The plan for GitHub Copilot was updated.",
     "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_plan",
       "plan",
-      "business_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1270,20 +1980,31 @@
     "description": "The plan for GitHub Copilot was scheduled to be downgraded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "current_plan",
       "scheduled_plan"
@@ -1294,21 +2015,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "owner_type",
       "actor_id",
-      "user_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1316,21 +2048,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "owner_type",
       "actor_id",
-      "user_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1338,21 +2081,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1362,19 +2114,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1384,21 +2145,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1408,18 +2178,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1432,18 +2215,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1457,14 +2253,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -1477,8 +2288,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1487,27 +2297,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1516,19 +2334,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1537,16 +2367,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "definition_id"
@@ -1558,19 +2401,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1579,19 +2433,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1600,19 +2465,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1621,38 +2497,62 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
-  },
-  {
-    "action": "dependabot_repository_access.repositories_updated",
-    "description": "The repositories that Dependabot can access were updated.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
+  },
+  {
+    "action": "dependabot_repository_access.repositories_updated",
+    "description": "The repositories that Dependabot can access were updated.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1660,19 +2560,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1681,19 +2592,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1701,19 +2623,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1722,19 +2655,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1742,19 +2686,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1763,19 +2718,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1783,19 +2749,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1804,20 +2781,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1825,21 +2812,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "repo_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "org_id",
-      "_document_id",
       "actor_id",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1847,20 +2843,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "request_id",
-      "org",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1868,22 +2874,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "org_id",
-      "actor",
-      "org",
-      "action",
       "operation_type",
-      "@timestamp",
-      "request_id",
       "title",
-      "_document_id",
-      "created_at",
-      "repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -1891,21 +2906,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "team",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "number",
-      "org",
-      "title",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id"
+      "team",
+      "created_at",
+      "number",
+      "title",
+      "operation_type"
     ]
   },
   {
@@ -1913,18 +2940,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user_id",
-      "actor",
       "number",
-      "user",
-      "created_at",
-      "request_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1932,18 +2972,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "_document_id",
-      "request_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "number",
       "team",
       "created_at"
@@ -1954,21 +3005,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "_document_id",
-      "title",
-      "user",
-      "user_agent",
-      "org",
-      "operation_type",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "team",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type",
+      "team",
       "number"
     ]
   },
@@ -1977,17 +3039,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -1998,16 +3074,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2018,18 +3108,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
       "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2040,17 +3144,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was created.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "org_id",
       "action",
-      "request_id",
-      "org",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -2059,17 +3176,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "actor_id",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -2078,22 +3208,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2102,22 +3241,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2125,28 +3274,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2155,27 +3310,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2184,25 +3347,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2211,26 +3382,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2239,21 +3417,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2262,22 +3452,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2286,25 +3486,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2313,22 +3522,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2337,21 +3558,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -2362,19 +3593,30 @@
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2383,20 +3625,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2405,19 +3657,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2426,23 +3689,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2450,18 +3722,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2472,20 +3754,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2495,25 +3787,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "name",
-      "events",
-      "active",
-      "active_was",
-      "hook_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "events",
+      "active",
+      "active_was",
+      "hook_id",
+      "operation_type"
     ]
   },
   {
@@ -2521,25 +3823,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -2547,26 +3858,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -2575,25 +3895,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -2601,26 +3930,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -2628,21 +3966,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -2651,19 +4000,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -2671,21 +4033,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -2694,19 +4067,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -2717,20 +4104,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2740,24 +4139,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2768,23 +4178,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2795,21 +4217,33 @@
     "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
       "operation_type",
-      "@timestamp",
       "integration",
-      "action",
-      "user_agent",
       "reason",
-      "_document_id",
-      "org",
-      "org_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -2820,20 +4254,32 @@
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
       "@timestamp",
-      "actor_id",
-      "org",
       "_document_id",
-      "requester",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "requester",
       "created_at",
       "url",
-      "org_id",
-      "request_id",
       "operation_type",
-      "actor",
       "integration",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -2843,20 +4289,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2866,19 +4325,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -2887,20 +4360,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -2910,20 +4396,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -2932,20 +4431,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -2954,20 +4466,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2975,19 +4499,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2996,19 +4533,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -3017,17 +4567,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -3040,21 +4603,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -3068,17 +4644,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -3090,19 +4679,30 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "user"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3110,19 +4710,30 @@
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3130,20 +4741,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "user_id",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
-      "_document_id",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "actor_id",
       "operation_type",
-      "org",
       "created_at"
     ]
   },
@@ -3152,19 +4772,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3172,24 +4803,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3197,24 +4836,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "ip_allow_list_entry",
-      "org",
-      "operation_type",
-      "created_at",
-      "active",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at",
+      "active"
     ]
   },
   {
@@ -3222,19 +4869,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "actor_id",
       "ip_allow_list_entry",
-      "active",
-      "org_id",
-      "@timestamp"
+      "active"
     ]
   },
   {
@@ -3242,22 +4902,31 @@
     "description": "A comment on an issue was deleted from the repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "org",
-      "repo",
-      "actor_id",
       "@timestamp",
-      "created_at",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "oauth_application_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -3265,24 +4934,30 @@
     "description": "A comment on an issue was pinned to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3293,19 +4968,29 @@
     "description": "A comment on an issue was unpinned from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3316,44 +5001,63 @@
     "description": "A comment on an issue (other than the initial one) changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
-      "repo_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
+      "oauth_application_id"
+    ]
+  },
+  {
+    "action": "issue.destroy",
+    "description": "An issue was deleted from the repository.",
+    "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue",
+    "fields": [
       "@timestamp",
-      "user_agent",
-      "request_id",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
-      "oauth_application_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "issue.destroy",
-    "description": "An issue was deleted from the repository.",
-    "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue",
-    "fields": [
       "user",
-      "actor_id",
-      "created_at",
-      "title",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "actor",
       "user_id",
-      "action",
-      "operation_type",
       "user_agent",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at",
+      "title",
+      "operation_type"
     ],
     "docs_reference_titles": "Deleting an issue"
   },
@@ -3362,23 +5066,33 @@
     "description": "An issue was pinned to a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
       "action",
       "actor",
-      "operation_type",
-      "owner_type",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "number",
-      "repo",
-      "event",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "owner_type",
+      "number",
+      "event"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3387,22 +5101,32 @@
     "description": "An issue was transferred to another repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "owner_type",
-      "actor_id",
       "number",
-      "repo",
       "operation_type",
-      "_document_id",
-      "repo_id",
-      "action",
-      "request_id",
-      "created_at",
-      "actor",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Transferring an issue to another repository"
   },
@@ -3411,24 +5135,33 @@
     "description": "An issue was unpinned from a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
-      "event",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
-      "action",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "operation_type",
-      "_document_id",
-      "number",
-      "owner_type",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "token_scopes",
-      "request_access_security_header"
+      "user_agent",
+      "event",
+      "created_at",
+      "operation_type",
+      "number",
+      "owner_type"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3437,19 +5170,30 @@
     "description": "The ability for enterprise members to delete issues was disabled  Members cannot delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
-      "operation_type",
-      "request_id",
-      "actor_id",
-      "user_id",
-      "created_at",
       "_document_id",
+      "action",
       "actor",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "org_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3458,18 +5202,29 @@
     "description": "The ability for enterprise members to delete issues was enabled  Members can delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -3479,19 +5234,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user",
-      "request_id",
-      "actor",
-      "business_id",
-      "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3500,18 +5266,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3519,21 +5297,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -3541,21 +5332,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
       "marketplace_listing",
-      "@timestamp",
       "integration",
-      "org_id",
-      "action",
-      "org",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3563,22 +5367,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -3586,19 +5403,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -3608,22 +5438,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -3631,22 +5474,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3654,20 +5510,30 @@
     "description": "The ability for members to publish GitHub Pages sites was disabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3676,20 +5542,30 @@
     "description": "The ability for members to publish GitHub Pages sites was enabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3698,21 +5574,30 @@
     "description": "The ability for members to publish private GitHub Pages was disabled  Members cannot publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3721,22 +5606,30 @@
     "description": "The ability for members to publish private GitHub Pages was enabled  Members can publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3745,21 +5638,30 @@
     "description": "The ability for members to publish public GitHub Pages was disabled  Members cannot publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3768,22 +5670,30 @@
     "description": "The ability for members to publish public GitHub Pages was enabled  Members can publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3792,19 +5702,30 @@
     "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "operation_type",
       "user_agent",
-      "actor",
-      "actor_id",
-      "business_id",
-      "@timestamp",
-      "created_at",
-      "action"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3813,18 +5734,29 @@
     "description": "The ability for enterprise members to delete repositories was disabled  Members cannot delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "request_id",
-      "org",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "actor",
       "operation_type",
-      "org_id",
-      "action",
-      "@timestamp",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -3834,21 +5766,30 @@
     "description": "The ability for enterprise members to delete repositories was enabled  Members can delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "action",
-      "org_id",
-      "user_id",
-      "business",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
-      "org",
-      "operation_type",
-      "user_agent"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3859,16 +5800,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -3877,21 +5829,30 @@
     "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "created_at",
-      "user_id",
       "business_id",
-      "user",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "org_id",
-      "@timestamp"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -3900,19 +5861,30 @@
     "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "user_id",
-      "business",
-      "business_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "actor_id"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -3921,19 +5893,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3941,21 +5925,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3965,16 +5958,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3984,18 +5990,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4005,14 +6024,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -4020,19 +6055,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -4040,18 +6086,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4059,23 +6117,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -4083,16 +6149,30 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "org_id",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4100,24 +6180,32 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
-      "repo_id",
       "operation_type",
-      "@timestamp",
-      "user_agent",
       "created_at",
-      "org",
-      "action",
-      "_document_id",
-      "repo",
-      "actor",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4125,15 +6213,28 @@
     "description": "A network configuration for a hosted compute service was created.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4151,15 +6252,28 @@
     "description": "A network configuration for a hosted compute service was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4172,15 +6286,28 @@
     "description": "A network configuration for a hosted compute service was updated.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4197,20 +6324,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4219,20 +6358,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4241,20 +6392,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4263,20 +6426,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4285,19 +6460,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4306,20 +6494,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4328,20 +6528,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4350,19 +6562,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4371,17 +6596,28 @@
     "description": "An invitation sent to an organization to join an enterprise was accepted.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4392,20 +6628,30 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
   },
@@ -4414,21 +6660,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -4437,24 +6693,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4462,21 +6728,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -4484,20 +6760,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4505,22 +6791,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4528,20 +6822,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4549,22 +6853,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4572,21 +6884,31 @@
     "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "new_policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -4596,19 +6918,30 @@
     "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4617,19 +6950,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -4639,15 +6983,28 @@
     "description": "Third-party application access for outside collaborators was disabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4658,15 +7015,28 @@
     "description": "Third-party application access for outside collaborators was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4677,15 +7047,28 @@
     "description": "The organization was archived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4695,17 +7078,30 @@
     "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
   },
@@ -4714,21 +7110,32 @@
     "description": "An export of the organization's Git events was created.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "start",
       "end",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization"
   },
@@ -4737,16 +7144,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -4755,18 +7175,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
-      "actor",
-      "user_agent",
-      "org_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "blocked_user",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -4774,20 +7207,31 @@
     "action": "org.cancel_business_invitation",
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
-    "fields": [
-      "user_agent",
-      "request_id",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -4797,22 +7241,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "email",
-      "@timestamp",
-      "actor",
-      "action",
       "operation_type",
-      "user_agent",
-      "org",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -4820,19 +7275,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -4840,23 +7306,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4864,21 +7338,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4886,23 +7370,31 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4910,23 +7402,31 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4934,21 +7434,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -4957,21 +7466,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -4980,20 +7498,31 @@
     "description": "Access to use Codespaces on internal and private repositories was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "enablement",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "enablement",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization"
   },
@@ -5002,21 +7531,31 @@
     "description": "Ownership and payment for codespaces was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "owner_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
   },
@@ -5025,16 +7564,29 @@
     "description": "A team has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5044,16 +7596,29 @@
     "description": "A team has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5063,19 +7628,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -5084,17 +7660,30 @@
     "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -5103,21 +7692,30 @@
     "description": "A user has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5125,21 +7723,30 @@
     "description": "A user has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5147,16 +7754,29 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
@@ -5166,17 +7786,30 @@
     "description": "The interaction limit for prior contributors only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5185,17 +7818,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5205,16 +7851,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5223,17 +7882,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5242,17 +7914,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5261,22 +7946,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -5285,17 +7978,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5306,15 +8010,28 @@
     "description": "Server statistics were exported for the organization.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5325,18 +8042,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
-      "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -5345,20 +8074,31 @@
     "description": "A GitHub Actions secret was created for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5367,20 +8107,32 @@
     "description": "A GitHub Actions variable was created for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5389,21 +8141,33 @@
     "description": "A Codespaces or Dependabot secret was created for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5411,21 +8175,30 @@
     "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "org_id",
-      "business",
-      "action",
       "@timestamp",
-      "org",
       "_document_id",
-      "business_id",
+      "action",
       "actor",
-      "token_scopes",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "actor_is_bot",
       "oauth_credential_type",
       "managed_oauth_access_id",
@@ -5441,24 +8214,32 @@
     "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
-      "created_at",
-      "org_id",
-      "business_id",
-      "operation_type",
-      "request_id",
       "_document_id",
       "action",
+      "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "token_scopes",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot",
       "oauth_credential_type",
-      "request_access_security_header",
       "managed_oauth_access_id",
       "managed_token_id",
       "managed_oauth_scopes",
@@ -5472,21 +8253,32 @@
     "description": "An owner revoked authorized credentials.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "oauth_application_id",
-      "org_id",
       "operation_type",
-      "action",
-      "business",
-      "request_id",
       "created_at",
-      "business_id",
-      "actor_id",
-      "_document_id",
-      "user_agent",
       "oauth_credential_type",
       "managed_oauth_access_id",
       "managed_token_id",
@@ -5501,18 +8293,30 @@
     "description": "An organization was deleted by a user or staff.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "org_id",
-      "org",
       "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5520,20 +8324,30 @@
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -5542,16 +8356,29 @@
     "description": "Third-party application access restrictions for an organization were disabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization"
@@ -5561,19 +8388,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -5582,14 +8420,31 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sso_url",
       "issuer",
-      "action",
-      "@timestamp",
-      "_document_id",
       "created_at",
-      "org",
       "operation_type"
     ]
   },
@@ -5598,21 +8453,30 @@
     "description": "Display of IP addresses within audit log events for the organization was disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -5621,17 +8485,30 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5639,19 +8516,30 @@
     "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5659,19 +8547,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
-      "action",
-      "actor_id",
-      "org_id"
+      "created_at"
     ]
   },
   {
@@ -5679,19 +8578,30 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -5700,17 +8610,30 @@
     "description": "Third-party application access restrictions for an organization were enabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "operation_type",
-      "org",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization"
   },
@@ -5719,19 +8642,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -5740,19 +8674,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "sso_url",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "issuer",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "sso_url",
+      "created_at",
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -5761,21 +8708,30 @@
     "description": "Display of IP addresses within audit log events for the organization was enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -5784,17 +8740,30 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
   },
@@ -5803,17 +8772,30 @@
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -5822,18 +8804,31 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "manager",
       "operation_type",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5841,23 +8836,32 @@
     "description": "A new user was invited to join an organization.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
     "fields": [
-      "org",
-      "user_id",
-      "invitation_id",
-      "org_id",
-      "user",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -5866,17 +8870,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5886,19 +8901,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5906,19 +8932,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5926,19 +8963,31 @@
     "description": "Access to an organization was granted for an OAuth App.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "operation_type",
-      "org_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization"
@@ -5948,20 +8997,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -5970,18 +9030,31 @@
     "description": "Access was disabled for an OAuth App that was previously approved.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization",
     "fields": [
-      "request_id",
-      "url",
-      "created_at",
-      "org_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
@@ -5991,19 +9064,31 @@
     "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "url",
-      "org_id",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "url",
       "oauth_application_name"
     ]
   },
@@ -6012,20 +9097,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "url",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -6035,16 +9131,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6052,20 +9161,31 @@
     "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "reason",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "reason",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -6074,20 +9194,30 @@
     "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -6096,19 +9226,30 @@
     "description": "An organization owner downloaded the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6117,19 +9258,30 @@
     "description": "An organization owner generated the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6138,19 +9290,30 @@
     "description": "An organization owner printed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6159,19 +9322,30 @@
     "description": "An organization owner viewed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6180,19 +9354,31 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -6201,20 +9387,31 @@
     "description": "A GitHub Actions secret was removed from an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -6223,21 +9420,31 @@
     "description": "A GitHub Actions variable was removed from an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -6246,18 +9453,29 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
@@ -6267,22 +9485,32 @@
     "description": "A Codespaces or Dependabot secret was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6290,21 +9518,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6312,21 +9549,30 @@
     "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user",
-      "org_id",
-      "created_at",
-      "request_id",
       "@timestamp",
-      "action",
-      "operation_type",
-      "user_agent",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6334,21 +9580,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -6356,18 +9612,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -6376,19 +9644,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
-      "old_login",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_login",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6396,14 +9676,28 @@
     "description": "Triggered when a required workflow is created.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6414,14 +9708,28 @@
     "description": "Triggered when a required workflow is deleted.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -6432,14 +9740,28 @@
     "description": "Triggered when a required workflow is updated.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6450,20 +9772,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -6472,18 +9804,29 @@
     "description": "A member's linked identity was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
       "user_id",
-      "@timestamp",
-      "action",
-      "actor_id",
       "user_agent",
-      "_document_id",
-      "request_id",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
@@ -6493,19 +9836,30 @@
     "description": "A member's SAML session was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
-      "actor_id",
-      "created_at",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
   },
@@ -6514,21 +9868,33 @@
     "description": "A self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -6538,21 +9904,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6561,20 +9937,31 @@
     "description": "A self-hosted runner group was renamed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6583,23 +9970,33 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -6608,23 +10005,31 @@
     "description": "A self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6633,19 +10038,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -6654,25 +10072,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6681,21 +10110,32 @@
     "description": "The visibility of a self-hosted runner group was updated via the REST API.",
     "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
   },
@@ -6704,21 +10144,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -6728,21 +10177,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -6752,20 +10210,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6774,22 +10242,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6798,21 +10274,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6821,21 +10306,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6844,22 +10338,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6868,21 +10370,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6891,22 +10402,30 @@
     "description": "Generic secrets have been disabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6914,22 +10433,30 @@
     "description": "Generic secrets have been enabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6937,21 +10464,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -6961,21 +10497,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -6985,19 +10530,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7007,21 +10563,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7031,21 +10596,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7055,19 +10629,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7077,22 +10662,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7101,22 +10694,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7125,22 +10726,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7149,21 +10758,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7172,21 +10790,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7195,22 +10822,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7219,22 +10854,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7243,26 +10886,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -7271,26 +10923,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7298,28 +10958,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "org_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7327,26 +10995,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7354,15 +11030,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7371,15 +11064,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7388,7 +11098,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -7403,20 +11134,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -7425,16 +11167,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -7445,18 +11200,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -7465,17 +11233,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7483,18 +11264,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -7503,18 +11296,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "policy",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -7523,18 +11329,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -7543,22 +11361,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issuer",
-      "business",
       "operation_type",
       "created_at",
-      "request_id",
-      "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7566,21 +11394,32 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
   },
@@ -7589,19 +11428,30 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -7612,15 +11462,28 @@
     "description": "The organization was unarchived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7630,19 +11493,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
-      "oauth_application_id",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "blocked_user",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -7651,20 +11527,32 @@
     "description": "A GitHub Actions secret was updated for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "created_at",
       "key",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -7673,23 +11561,34 @@
     "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -7698,20 +11597,32 @@
     "description": "A GitHub Actions variable was updated for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -7720,20 +11631,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -7741,22 +11664,33 @@
     "description": "A Codespaces or Dependabot secret was updated for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7765,20 +11699,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -7786,17 +11731,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -7806,20 +11764,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -7828,17 +11797,30 @@
     "description": "The name of the default branch was changed for new repositories in the organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
   },
@@ -7847,17 +11829,30 @@
     "description": "The repository self-hosted runners policy was updated",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_repo_runners_policy",
       "new_repo_runners_policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -7868,19 +11863,32 @@
     "description": "An organization's SAML provider settings were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "issuer",
-      "org",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -7888,18 +11896,30 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "org",
-      "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
@@ -7908,18 +11928,30 @@
     "description": "A default label was created for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
-      "_document_id",
-      "action",
-      "created_at",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label"
   },
@@ -7928,17 +11960,30 @@
     "description": "A default label was deleted for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label"
   },
@@ -7947,17 +11992,30 @@
     "description": "A default label was edited for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label",
     "fields": [
-      "org",
-      "created_at",
       "@timestamp",
-      "actor",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label"
   },
@@ -7966,20 +12024,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "org_id",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -7988,16 +12059,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8006,14 +12092,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -8024,16 +12125,31 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "operation_type",
-      "domain_name",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
       "_document_id",
-      "actor_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "domain_name",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8042,16 +12158,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -8061,17 +12190,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8081,16 +12221,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -8100,20 +12253,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -8121,19 +12284,30 @@
     "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor",
-      "business_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
       "user_agent",
-      "_document_id",
       "created_at",
-      "operation_type",
-      "request_id",
-      "business"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -8142,19 +12316,30 @@
     "description": "Organization projects were disabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -8163,18 +12348,29 @@
     "description": "Organization projects were enabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor_id",
-      "org_id",
-      "created_at",
-      "user_id",
-      "org",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
@@ -8184,23 +12380,33 @@
     "description": "An organization role was assigned to a user or team.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About custom organization roles"
   },
@@ -8209,25 +12415,32 @@
     "description": "A custom organization role was created in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8239,25 +12452,32 @@
     "description": "A custom organization role was deleted in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8268,19 +12488,30 @@
     "description": "A user or team was unassigned an organization role.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type"
     ],
@@ -8291,26 +12522,33 @@
     "description": "A custom organization role was edited in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
       "old_role_permissions",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -8323,22 +12561,33 @@
     "description": "An organization's default project base role was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_project_base_role",
-      "new_project_base_role",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_project_base_role",
+      "new_project_base_role",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8346,20 +12595,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -8369,23 +12629,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8394,21 +12665,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -8419,21 +12701,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8442,20 +12737,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8464,17 +12773,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8485,20 +12809,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8507,18 +12845,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8526,16 +12876,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8543,18 +12907,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8562,18 +12938,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8584,22 +12973,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8607,22 +13005,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8630,18 +13037,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8652,18 +13072,28 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8674,18 +13104,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8696,23 +13136,34 @@
     "description": "A personal access token expiration limit was set.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "token_expiration",
       "old_token_expiration",
       "exempt_administrators",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8720,21 +13171,32 @@
     "description": "A personal access token expiration limit was unset.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "programmatic_access_type",
-      "old_token_expiration",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_token_expiration",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8742,17 +13204,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8763,18 +13238,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
-      "user",
-      "user_id",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8786,17 +13274,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8808,20 +13309,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -8833,20 +13343,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -8858,20 +13377,29 @@
     "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -8883,20 +13411,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -8908,15 +13445,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8926,17 +13478,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8946,15 +13509,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8964,19 +13542,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "business_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8984,23 +13573,30 @@
     "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "created_at",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
-      "repo",
       "action",
-      "user_agent",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9008,23 +13604,30 @@
     "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "repo",
-      "org",
-      "business",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org_id",
-      "created_at",
-      "business_id"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9032,17 +13635,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9052,17 +13666,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9072,17 +13697,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9092,17 +13728,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9112,17 +13759,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -9132,17 +13792,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9150,25 +13823,36 @@
     "description": "A project's base role was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_project_base_role",
       "new_project_base_role",
       "project_number",
       "public_project",
-      "business",
       "project_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9176,20 +13860,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -9199,25 +13894,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "collaborator_type",
-      "org",
-      "org_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -9225,20 +13932,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9246,25 +13965,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9272,17 +14003,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9290,17 +14034,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9308,18 +14065,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -9328,18 +14097,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -9348,19 +14129,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -9368,17 +14160,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -9390,22 +14195,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -9413,19 +14227,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "operation_type",
-      "actor",
-      "action",
-      "created_at",
-      "actor_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9433,17 +14258,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9451,18 +14289,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -9470,20 +14321,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9491,18 +14352,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -9511,18 +14384,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -9531,16 +14416,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -9552,21 +14450,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -9574,22 +14484,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -9598,29 +14518,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
-      "actor",
-      "actor_id",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9628,24 +14553,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "repo_id",
-      "user_id",
       "@timestamp",
-      "user_agent",
-      "repo",
-      "name",
-      "org_id",
-      "user",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -9656,21 +14589,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -9681,22 +14624,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -9704,24 +14657,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "authorized_actors_only",
       "authorized_actors",
       "created_at",
-      "user_agent",
       "name",
-      "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
-      "actor_id",
-      "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -9729,30 +14692,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -9762,28 +14732,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -9794,23 +14772,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -9818,22 +14805,32 @@
     "description": "Branch deletion was enabled or disabled for a protected branch.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "operation_type",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "org_id",
-      "org",
-      "action",
       "allow_deletions_enforcement_level",
-      "_document_id",
-      "created_at",
-      "actor_id",
-      "user_agent",
-      "actor",
-      "repo_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -9841,23 +14838,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "actor_id",
-      "name",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo",
-      "operation_type",
-      "request_id",
-      "allow_force_pushes_enforcement_level",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_force_pushes_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -9865,24 +14871,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -9891,22 +14906,32 @@
     "description": "Required linear commit history was enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "operation_type",
       "actor",
-      "linear_history_requirement_enforcement_level",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "linear_history_requirement_enforcement_level",
       "name",
-      "org_id",
-      "repo_id",
-      "org",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -9914,24 +14939,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "lock_allows_fetch_and_merge",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -9940,27 +14974,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -9969,18 +15010,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9991,24 +15045,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -10016,25 +15079,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -10042,22 +15112,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -10065,22 +15145,33 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
   },
@@ -10089,22 +15180,32 @@
     "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "required_approving_review_count",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10112,25 +15213,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
     ]
   },
   {
@@ -10138,22 +15246,32 @@
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
       "action",
       "actor",
       "actor_id",
-      "signature_requirement_enforcement_level",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "programmatic_access_type"
+      "operation_type",
+      "name",
+      "created_at",
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -10161,22 +15279,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "created_at",
-      "repo_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "name",
-      "actor",
-      "repo",
       "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
+      "strict_required_status_checks_policy"
     ]
   },
   {
@@ -10184,23 +15312,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -10209,24 +15348,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -10235,20 +15385,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10257,21 +15421,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -10281,22 +15458,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10305,25 +15494,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10332,23 +15531,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10357,18 +15567,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -10378,21 +15602,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -10401,19 +15636,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -10424,23 +15672,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -10450,17 +15710,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -10468,19 +15742,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -10488,19 +15775,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -10510,21 +15810,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -10533,27 +15844,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "pull_request_url",
       "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10561,23 +15879,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -10586,18 +15916,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -10605,19 +15949,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -10627,20 +15983,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
-      "repo",
-      "created_at",
-      "request_id",
-      "comment_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "comment_id",
+      "operation_type"
     ]
   },
   {
@@ -10648,18 +16015,31 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor_id",
-      "action",
+      "operation_type",
       "created_at",
-      "actor",
-      "_document_id",
-      "@timestamp",
-      "comment_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "comment_id"
     ]
   },
   {
@@ -10667,21 +16047,33 @@
     "description": "A review on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -10689,20 +16081,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -10711,19 +16116,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -10733,22 +16152,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -10757,21 +16186,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -10780,25 +16218,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -10807,23 +16252,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -10832,24 +16285,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -10858,23 +16318,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -10884,22 +16352,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -10908,19 +16385,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -10929,24 +16419,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -10955,24 +16455,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -10980,24 +16488,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11005,24 +16521,32 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11030,24 +16554,32 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11055,23 +16587,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11082,17 +16623,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
       "operation_type"
     ]
@@ -11102,17 +16655,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -11122,25 +16687,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11149,26 +16720,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11177,25 +16756,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "query_suite",
       "threat_model",
       "languages",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -11205,19 +16793,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to this repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -11226,19 +16825,30 @@
     "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11246,17 +16856,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11265,15 +16888,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -11284,16 +16920,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11303,17 +16952,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo_id",
-      "repo",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11323,19 +16985,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11344,17 +17017,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11363,26 +17049,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -11391,30 +17083,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -11424,20 +17121,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -11446,25 +17154,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -11473,23 +17189,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11497,25 +17224,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -11525,23 +17261,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -11551,23 +17296,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -11575,21 +17330,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11597,21 +17362,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -11619,22 +17394,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -11642,21 +17426,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -11664,20 +17458,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11685,22 +17490,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11708,18 +17522,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11727,22 +17555,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11750,21 +17588,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11772,18 +17620,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -11792,22 +17652,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -11816,24 +17685,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -11842,23 +17719,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11866,26 +17753,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -11894,21 +17786,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -11917,25 +17818,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11943,22 +17850,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -11967,25 +17884,34 @@
     "description": "A branch was renamed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "old_branch",
-      "new_branch",
-      "default_branch",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "old_branch",
+      "new_branch",
+      "default_branch",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch"
@@ -11995,19 +17921,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12015,17 +17952,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12034,17 +17986,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12053,7 +18020,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -12068,23 +18056,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -12094,20 +18091,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -12118,21 +18126,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -12141,22 +18160,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -12165,21 +18194,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -12188,22 +18228,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -12214,16 +18264,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -12233,22 +18294,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -12257,23 +18329,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12283,19 +18365,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -12303,21 +18395,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -12326,50 +18428,66 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
     "action": "repo.update_actions_secret",
     "description": "A GitHub Actions secret was updated for a repository.",
-    "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
+    "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
+    "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12378,24 +18496,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12404,25 +18532,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12431,22 +18567,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12455,26 +18600,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12482,31 +18635,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12515,22 +18675,30 @@
     "description": "Someone closed a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories",
     "fields": [
-      "actor",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "created_at",
-      "repo_id",
-      "_document_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "About repository security advisories"
   },
@@ -12539,18 +18707,29 @@
     "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "_document_id",
+      "operation_type",
       "created_at"
     ]
   },
@@ -12559,17 +18738,30 @@
     "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -12577,22 +18769,31 @@
     "action": "repository_advisory.github_withdraw",
     "description": "GitHub withdrew a security advisory that was published in error.",
     "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -12600,18 +18801,30 @@
     "description": "Someone opened a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
       "repo_id",
-      "action",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12619,21 +18832,30 @@
     "description": "Someone published a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "repo_id",
       "_document_id",
-      "repo",
-      "business_id",
-      "business",
-      "request_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "org"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12641,17 +18863,30 @@
     "description": "Someone reopened as draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "repo",
-      "action",
-      "created_at",
       "@timestamp",
-      "request_id",
-      "actor_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "public_repo"
     ]
   },
@@ -12660,21 +18895,30 @@
     "description": "Someone edited a draft or published security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "repo_id",
-      "org_id",
       "business",
-      "actor",
-      "user_agent",
-      "created_at",
-      "_document_id",
       "business_id",
-      "repo",
-      "action",
-      "operation_type",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12682,24 +18926,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -12708,24 +18958,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -12734,19 +18990,30 @@
     "description": "Data use settings were disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "repo_id",
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -12755,21 +19022,30 @@
     "description": "Data use settings were enabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "org",
-      "user_id",
-      "repo_id",
       "@timestamp",
-      "request_id",
-      "actor",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org_id",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -12778,23 +19054,30 @@
     "description": "The dependency graph was disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "repo_id",
-      "operation_type",
-      "user_id",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
-      "@timestamp",
-      "org_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -12803,24 +19086,31 @@
     "description": "The dependency graph was enabled for a private repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor_id",
-      "repo_id",
+      "created_at",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12829,21 +19119,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -12851,21 +19151,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12873,21 +19183,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -12895,20 +19216,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -12916,21 +19249,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12938,19 +19282,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -12958,17 +19315,31 @@
     "description": "An organization has reached their repository limit.",
     "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "limit",
-      "count",
-      "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "count",
+      "owner",
       "created_at",
       "operation_type"
     ],
@@ -12979,17 +19350,31 @@
     "description": "An organization is approaching their repository limit.",
     "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "limit",
       "count",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -13000,19 +19385,30 @@
     "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise  Organization owners can now control their repository projects settings.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "user_agent",
-      "user",
-      "business_id",
-      "business",
-      "operation_type",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -13021,20 +19417,30 @@
     "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
       "@timestamp",
-      "repo",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "repo_id",
-      "actor",
-      "request_id",
-      "programmatic_access_type"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13043,20 +19449,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
       "created_at",
-      "org_id",
-      "action",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "actor_id",
-      "repo"
+      "operation_type"
     ]
   },
   {
@@ -13064,31 +19479,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -13097,19 +19520,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -13117,8 +19551,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -13127,23 +19560,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -13168,26 +19610,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -13196,26 +19644,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -13224,23 +19678,30 @@
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13250,23 +19711,30 @@
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13276,24 +19744,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13303,24 +19778,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -13329,24 +19811,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13356,23 +19845,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13382,23 +19878,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13407,22 +19911,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13430,24 +19942,32 @@
     "description": "Generic secrets have been disabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13455,22 +19975,31 @@
     "description": "Generic secrets have been enabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13479,24 +20008,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -13505,24 +20042,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -13531,19 +20076,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13552,24 +20109,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13578,24 +20143,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13604,19 +20177,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13625,26 +20210,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13653,26 +20243,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13681,28 +20276,36 @@
     "description": "A code security configuration was applied to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13710,27 +20313,35 @@
     "description": "A code security configuration failed to attach to the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13738,28 +20349,36 @@
     "description": "A code security configuration was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13767,28 +20386,36 @@
     "description": "A code security configuration was removed due to a change in repository or enterprise settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13796,20 +20423,30 @@
     "description": "The repository visibility change setting was cleared for an organization or enterprise.",
     "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
       "business",
-      "action",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business_id",
-      "@timestamp",
       "user_agent",
-      "actor",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise"
   },
@@ -13818,20 +20455,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "org_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
-      "user_id",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13839,19 +20486,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "_document_id",
       "@timestamp",
-      "user_agent",
-      "user",
-      "created_at",
-      "org",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13859,29 +20517,37 @@
     "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -13890,29 +20556,37 @@
     "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "alert_id",
-      "alert_number",
-      "ghsa_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "alert_number",
+      "ghsa_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -13921,19 +20595,32 @@
     "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
-      "operation_type",
-      "request_id",
-      "repo_id",
       "@timestamp",
-      "user_agent",
-      "alert_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "alert_id",
+      "created_at",
+      "alert_number"
     ],
     "docs_reference_titles": "About Dependabot alerts"
   },
@@ -13942,23 +20629,32 @@
     "description": "A Dependabot alert was manually dismissed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "alert_id",
-      "actor",
-      "repo",
       "created_at",
-      "org",
-      "_document_id",
-      "action",
-      "actor_id",
       "dismiss_reason",
-      "user",
       "dismiss_comment",
       "alert_number",
       "actor_is_bot"
@@ -13969,21 +20665,33 @@
     "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "public_repo",
       "owner",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "token_scopes",
       "alert_number"
     ]
   },
@@ -13992,26 +20700,34 @@
     "description": "A Dependabot alert was manually reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo",
-      "alert_number",
-      "request_access_security_header"
+      "alert_number"
     ]
   },
   {
@@ -14019,21 +20735,32 @@
     "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "alert_id",
-      "repo",
-      "operation_type",
-      "action",
-      "repo_id",
-      "_document_id",
-      "user_agent",
-      "request_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "operation_type",
+      "created_at",
+      "alert_number"
     ]
   },
   {
@@ -14041,21 +20768,35 @@
     "description": "A Dependabot alert was withdrawn.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
       "created_at",
       "active",
-      "action",
-      "repository_id",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type"
     ]
   },
@@ -14064,20 +20805,30 @@
     "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
     "fields": [
-      "org",
+      "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
-      "operation_type",
-      "created_at",
-      "actor",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
   },
@@ -14086,24 +20837,31 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -14111,26 +20869,32 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14138,23 +20902,30 @@
     "description": "Dependabot alerts was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "request_id",
-      "repo_id",
-      "action",
-      "actor_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "_document_id",
       "user_id",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14162,23 +20933,30 @@
     "description": "Dependabot alerts was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_agent",
-      "created_at",
       "@timestamp",
-      "repo_id",
+      "_document_id",
       "action",
-      "user",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor_id",
-      "_document_id",
-      "user_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -14187,24 +20965,31 @@
     "description": "A status check was marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "org",
-      "actor_id",
       "@timestamp",
-      "business",
-      "request_id",
-      "context",
-      "repo_id",
-      "action",
-      "repo",
       "_document_id",
-      "operation_type",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "created_at",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "context",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -14213,21 +20998,31 @@
     "description": "A status check was no longer marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "actor_id",
-      "actor",
-      "created_at",
-      "context",
-      "operation_type",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "repo_id",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
       "repo",
-      "programmatic_access_type"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "context",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -14236,18 +21031,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -14256,19 +21064,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -14277,22 +21097,33 @@
     "description": "A new custom repository role was created.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "role_permissions",
       "old_role_permissions"
     ],
@@ -14303,23 +21134,34 @@
     "description": "A custom repository role was deleted.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing custom repository roles for an organization"
   },
@@ -14327,24 +21169,35 @@
     "action": "role.update",
     "description": "A custom repository role was edited.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
-    "fields": [
-      "user_agent",
-      "request_id",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "old_role_permissions",
       "old_base_role"
     ],
@@ -14355,14 +21208,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -14376,14 +21243,28 @@
     "description": "A secret scanning alert was leaked in a public repo.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -14398,22 +21279,32 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
@@ -14422,14 +21313,28 @@
     "description": "A leaked secret was reported to the secret's provider by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "created_at",
@@ -14444,28 +21349,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -14473,25 +21387,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -14499,14 +21420,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -14523,26 +21458,34 @@
     "description": "A request to close a secret scanning alert was approved by a user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "request_reviewer_comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14551,25 +21494,33 @@
     "description": "N/A",
     "docs_reference_links": "A reqeust to close a secret scanning alert was canceled by a user.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "A, reqeust, to, close, a, secret, scanning, alert, was, canceled, by, a, user."
@@ -14579,27 +21530,35 @@
     "description": "N/A",
     "docs_reference_links": "A user requested to close a secret scanning alert.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "reason",
       "comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "A, user, requested, to, close, a, secret, scanning, alert."
@@ -14609,26 +21568,34 @@
     "description": "A request to close a secret scanning alert was denied by a user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "request_reviewer_comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14637,19 +21604,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14658,19 +21636,30 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14679,20 +21668,30 @@
     "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14701,19 +21700,30 @@
     "description": "Secret scanning was enabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14722,14 +21732,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -14747,25 +21771,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14774,25 +21806,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -14802,25 +21842,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -14829,22 +21877,35 @@
     "description": "A secret scanning scan has completed on this repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "repo_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "source",
       "type",
       "source_slug",
       "type_slug",
       "started_at",
       "completed_at",
-      "repo",
       "public_repo",
-      "org",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "secret_types",
@@ -14858,10 +21919,28 @@
     "description": "A security configuration was created",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -14876,15 +21955,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14902,22 +21974,33 @@
     "description": "A default security configuration setting for new repositories was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14926,22 +22009,33 @@
     "description": "A default security configuration setting for new repositories was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14950,10 +22044,28 @@
     "description": "A security configuration was deleted",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -14968,15 +22080,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14993,15 +22098,30 @@
     "description": "A security configuration policy was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enforcement",
       "security_configuration_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15011,10 +22131,28 @@
     "description": "A security configuration was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15029,15 +22167,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15055,16 +22186,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15074,18 +22218,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -15094,16 +22251,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15113,15 +22283,28 @@
     "description": "An agreement for invoiced billing for GitHub Sponsors was signed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -15133,15 +22316,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -15151,15 +22347,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -15168,17 +22379,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -15187,17 +22411,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -15206,16 +22444,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -15225,14 +22476,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -15242,17 +22508,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -15260,18 +22539,31 @@
     "action": "sponsors.sponsored_developer_create",
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
-    "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
+    "fields": [
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -15280,18 +22572,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15300,15 +22605,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -15318,16 +22637,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15335,15 +22667,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -15354,16 +22699,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -15373,17 +22731,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -15394,17 +22765,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -15415,18 +22799,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15436,16 +22831,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15455,16 +22863,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15476,17 +22897,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15495,19 +22929,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15516,21 +22963,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "user",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
       "action",
-      "user_id",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "actor_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15539,19 +22995,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15560,15 +23027,28 @@
     "description": "Dependabot encrypted config was read.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "public_repo"
@@ -15579,20 +23059,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15600,18 +23094,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -15619,16 +23128,31 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "domain_name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15636,23 +23160,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15660,23 +23194,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15684,23 +23228,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15708,23 +23262,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15732,21 +23296,31 @@
     "description": "A member of an organization was added to a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
-      "user",
       "@timestamp",
-      "actor_id",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "org",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -15756,22 +23330,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -15780,20 +23363,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -15802,18 +23396,31 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
       "created_at",
       "operation_type",
-      "actor_id",
-      "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
@@ -15823,21 +23430,32 @@
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -15846,21 +23464,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -15869,19 +23497,31 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "team",
       "org_id",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
       "operation_type",
-      "_document_id",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -15890,19 +23530,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
       "business",
-      "action",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15910,19 +23561,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "request_id",
       "actor",
-      "org",
-      "created_at",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15930,18 +23592,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
       "@timestamp",
-      "action",
       "_document_id",
-      "user_agent",
-      "user_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -15950,19 +23623,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "actor",
-      "action",
-      "operation_type",
-      "team",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -15970,19 +23655,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "actor_id",
       "_document_id",
-      "team",
-      "created_at",
-      "org_id",
       "action",
-      "request_id",
-      "user_agent",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_access_security_header"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "team",
+      "created_at"
     ]
   },
   {
@@ -15990,22 +23687,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "team",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16013,22 +23719,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -16037,22 +23752,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -16060,23 +23784,33 @@
   {
     "action": "team.remove_repository",
     "description": "A repository was removed from a team's control.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "org",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -16084,21 +23818,32 @@
     "description": "A team's name was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "user_agent",
-      "created_at",
-      "team",
-      "operation_type",
-      "actor_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -16107,17 +23852,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -16126,19 +23884,30 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -16147,19 +23916,30 @@
     "description": "The Okta credentials for team synchronization with a tenant were changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -16167,28 +23947,37 @@
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
       "operation_type",
       "created_at",
-      "user_agent",
       "permission",
       "new_repo_permission",
       "new_repo_base_role",
       "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_repo_base_role"
     ]
   },
   {
@@ -16196,16 +23985,30 @@
     "description": "A Dependabot rule was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16215,16 +24018,30 @@
     "description": "A Dependabot rule was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16234,18 +24051,31 @@
     "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16255,21 +24085,33 @@
     "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -16277,21 +24119,32 @@
     "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -16299,21 +24152,32 @@
     "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -16321,16 +24185,30 @@
     "description": "A Dependabot rule's conditions, actions, or metadata changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16340,27 +24218,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -16369,23 +24253,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -16393,10 +24287,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -16407,20 +24319,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -16429,23 +24330,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16455,10 +24364,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -16470,19 +24397,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -16493,10 +24410,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -16505,21 +24440,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -16529,23 +24453,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -16554,22 +24490,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16577,21 +24524,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -16599,25 +24557,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16625,23 +24591,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -16655,24 +24634,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -16681,10 +24669,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -16694,21 +24700,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -16718,25 +24714,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.17/user.json b/src/audit-logs/data/ghes-3.17/user.json
index 1b7dfef9655a..35b1e5e0f5d6 100644
--- a/src/audit-logs/data/ghes-3.17/user.json
+++ b/src/audit-logs/data/ghes-3.17/user.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,17 +67,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
-      "user_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -61,18 +98,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
+      "token_scopes",
       "user",
-      "request_id",
-      "_document_id",
-      "user_agent",
-      "actor",
       "user_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -80,18 +129,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "token_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -99,29 +160,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -129,18 +196,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -148,17 +227,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -167,19 +259,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -188,18 +292,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -207,18 +324,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -226,15 +355,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -244,26 +386,36 @@
     "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -271,24 +423,34 @@
     "description": "A CSV export was requested on the \"Coverage\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -296,26 +458,36 @@
     "description": "A CSV export was requested on the \"Overview Dashboard\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -323,20 +495,31 @@
     "description": "A CSV export was requested on the \"Risk\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -347,17 +530,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -368,20 +564,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -390,19 +598,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -411,19 +632,31 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -432,20 +665,32 @@
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -454,19 +699,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -475,20 +732,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -497,20 +765,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -521,17 +800,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -539,14 +830,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -556,25 +862,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -585,22 +900,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -612,22 +938,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -636,36 +973,64 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "public_repo"
-    ]
-  },
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "owner",
+      "created_at",
+      "operation_type",
+      "public_repo"
+    ]
+  },
   {
     "action": "codespaces.restore",
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -675,27 +1040,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "org",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -703,19 +1077,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -723,18 +1110,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -743,23 +1142,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -767,16 +1173,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -785,24 +1205,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -810,15 +1236,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -828,40 +1267,62 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "copilot.cfb_seat_cancelled",
-    "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "copilot.cfb_seat_cancelled",
+    "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -869,21 +1330,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -891,21 +1361,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "owner_type",
       "actor_id",
-      "user_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -913,21 +1394,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "owner_type",
       "actor_id",
-      "user_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -935,21 +1427,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -959,19 +1460,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -981,21 +1491,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1005,19 +1524,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1026,19 +1556,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1047,19 +1588,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1068,19 +1620,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1089,17 +1652,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1107,19 +1683,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1128,19 +1715,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1148,19 +1746,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1169,19 +1778,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1189,19 +1809,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1210,39 +1841,61 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
-    ]
-  },
-  {
-    "action": "dependency_graph_new_repos.disable",
-    "description": "The dependency graph was disabled for all new repositories.",
-    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
-    "fields": [
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "dependency_graph_new_repos.disable",
+    "description": "The dependency graph was disabled for all new repositories.",
+    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1251,20 +1904,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1272,22 +1935,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1296,22 +1968,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1319,28 +2001,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1349,27 +2037,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1378,25 +2074,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1405,49 +2109,68 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "Managing environments for deployment"
-  },
-  {
-    "action": "environment.remove_actions_variable",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at",
+      "public_repo"
+    ],
+    "docs_reference_titles": "Managing environments for deployment"
+  },
+  {
+    "action": "environment.remove_actions_variable",
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1456,22 +2179,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1480,25 +2213,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1507,22 +2249,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1531,21 +2285,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -1556,21 +2320,32 @@
     "description": "A gist was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "gist_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "visibility",
-      "action",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ]
   },
   {
@@ -1578,20 +2353,32 @@
     "description": "A gist was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "gist_id",
-      "visibility",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "user",
-      "request_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "programmatic_access_type"
+      "gist_id",
+      "visibility",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1599,21 +2386,32 @@
     "description": "The visibility of a gist was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "user",
-      "gist_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "visibility",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "gist_id",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -1621,22 +2419,33 @@
     "description": "An SSH key was added to a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1645,23 +2454,34 @@
     "description": "An SSH key was removed from a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
       "explanation",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1670,23 +2490,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1694,18 +2523,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1716,20 +2555,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1739,18 +2588,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "user",
-      "operation_type",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1758,18 +2619,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1777,25 +2650,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -1803,25 +2686,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -1829,26 +2721,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -1857,25 +2758,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -1883,26 +2793,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -1910,21 +2829,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -1933,19 +2863,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -1953,21 +2896,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -1976,19 +2930,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -1999,20 +2967,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2022,24 +3002,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2050,23 +3041,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2077,20 +3080,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2100,19 +3116,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -2121,20 +3151,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -2144,20 +3187,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -2166,20 +3222,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -2188,20 +3257,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2209,19 +3290,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2230,38 +3324,64 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "name",
-      "integration",
-      "user",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "application_client_id"
-    ]
-  },
-  {
-    "action": "integration.suspend",
-    "description": "A GitHub App was suspended.",
-    "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
-    "fields": [
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
+      "operation_type",
+      "created_at",
+      "application_client_id"
+    ]
+  },
+  {
+    "action": "integration.suspend",
+    "description": "A GitHub App was suspended.",
+    "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2274,21 +3394,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -2302,17 +3435,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2324,18 +3470,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2343,21 +3501,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -2365,21 +3536,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2387,22 +3571,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -2410,19 +3607,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -2433,21 +3643,36 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
       "action",
-      "operation_type",
-      "marketplace_listing",
-      "has_free_trial",
-      "user_agent",
-      "request_id",
+      "actor",
       "actor_id",
-      "yearly_price_in_cents",
-      "description",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "marketplace_listing",
+      "has_free_trial",
+      "yearly_price_in_cents",
+      "description",
       "bullets",
       "monthly_price_in_cents",
-      "marketplace_listing_plan",
-      "_document_id"
+      "marketplace_listing_plan"
     ]
   },
   {
@@ -2455,22 +3680,37 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "marketplace_listing_plan",
       "marketplace_listing",
       "description",
       "bullets",
       "has_free_trial",
       "created_at",
-      "actor_id",
       "operation_type",
-      "_document_id",
-      "action",
-      "user_agent",
-      "request_id",
-      "actor",
       "monthly_price_in_cents",
-      "yearly_price_in_cents",
-      "@timestamp"
+      "yearly_price_in_cents"
     ]
   },
   {
@@ -2478,21 +3718,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "marketplace_listing_plan",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "marketplace_listing_plan",
       "description",
       "yearly_price_in_cents",
-      "@timestamp",
       "created_at",
-      "actor_id",
       "bullets",
       "has_free_trial",
       "marketplace_listing",
-      "user_agent",
       "monthly_price_in_cents",
-      "action",
       "operation_type"
     ]
   },
@@ -2501,21 +3756,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "monthly_price_in_cents",
-      "marketplace_listing",
+      "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "monthly_price_in_cents",
+      "marketplace_listing",
       "description",
       "bullets",
       "yearly_price_in_cents",
-      "request_id",
-      "actor_id",
       "has_free_trial",
       "marketplace_listing_plan",
-      "user_agent",
-      "@timestamp",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -2524,22 +3794,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -2547,22 +3830,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2570,19 +3866,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2590,21 +3898,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2614,16 +3931,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2633,18 +3963,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "max_entries_to_build",
-      "min_entries_to_merge",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "max_entries_to_build",
+      "min_entries_to_merge",
+      "public_repo",
       "created_at",
       "operation_type"
     ]
@@ -2654,14 +3997,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2669,19 +4028,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -2689,18 +4059,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2708,23 +4090,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -2732,20 +4122,30 @@
     "description": "An OAuth access token was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
     "fields": [
-      "_document_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "user",
-      "user_id",
-      "created_at",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "request_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
@@ -2756,19 +4156,30 @@
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "explanation",
-      "hashed_token",
-      "actor_id",
-      "token_scopes",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
@@ -2778,19 +4189,30 @@
     "description": "An OAuth access token was regenerated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "_document_id",
-      "created_at",
       "@timestamp",
-      "operation_type",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ]
   },
@@ -2799,16 +4221,28 @@
     "description": "An OAuth access token was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "request_access_security_header",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
       "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2818,39 +4252,63 @@
     "description": "An OAuth access token was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
       "action",
-      "@timestamp",
-      "user",
-      "user_agent",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "oauth_application.create",
-    "description": "An OAuth application was created.",
-    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
-    "fields": [
-      "org",
-      "created_at",
-      "oauth_application_id",
-      "operation_type",
-      "user_agent",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "actor",
-      "oauth_application",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "oauth_application.create",
+    "description": "An OAuth application was created.",
+    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+    "fields": [
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2859,20 +4317,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2881,20 +4351,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2903,20 +4385,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2925,19 +4419,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2946,20 +4453,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2968,20 +4487,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2990,19 +4521,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3011,24 +4555,31 @@
     "description": "An authorization for an OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "user_id",
-      "actor",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
       "actor_id",
-      "user",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "actor_is_bot",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -3038,20 +4589,31 @@
     "description": "An authorization for an OAuth application was deleted.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "actor",
       "created_at",
       "explanation",
-      "user",
-      "user_id",
-      "org_id",
-      "action",
-      "actor_id",
-      "token_scopes",
       "actor_is_bot",
       "oauth_application_name"
     ],
@@ -3062,20 +4624,31 @@
     "description": "An authorization for an OAuth application was updated.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
-      "actor_id",
       "user_agent",
-      "@timestamp",
       "operation_type",
-      "action",
-      "user",
       "created_at",
-      "_document_id",
       "actor_is_bot",
-      "request_access_security_header",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -3085,21 +4658,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -3108,24 +4691,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3133,20 +4726,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3154,22 +4757,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3177,20 +4788,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3198,22 +4819,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3221,48 +4850,66 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
-    ]
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
   },
   {
     "action": "org.security_center_export_code_scanning_metrics",
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -3271,26 +4918,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3298,28 +4953,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3327,26 +4990,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3354,20 +5025,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -3376,16 +5058,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -3396,18 +5091,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -3416,18 +5124,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -3436,18 +5156,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -3456,18 +5189,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -3477,20 +5222,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -3498,17 +5254,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -3518,20 +5287,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -3540,20 +5320,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -3562,17 +5356,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3583,20 +5392,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -3605,19 +5428,31 @@
     "description": "A new passkey was added.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3625,19 +5460,31 @@
     "description": "A new passkey was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3645,35 +5492,61 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "payment_method.remove",
-    "description": "A payment method was removed.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user",
-      "created_at",
-      "actor_id",
-      "@timestamp",
-      "user_id",
-      "action",
-      "operation_type",
-      "actor",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "payment_method.remove",
+    "description": "A payment method was removed.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
       "_document_id",
-      "request_access_security_header"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3681,18 +5554,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3700,18 +5585,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3722,18 +5620,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3744,17 +5655,30 @@
     "description": "Triggered when you create a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3764,19 +5688,31 @@
     "description": "Triggered when you regenerate a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3784,12 +5720,29 @@
     "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
     "fields": [
-      "user_programmatic_access_name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
       "operation_type"
     ],
@@ -3800,20 +5753,32 @@
     "description": "Triggered when you delete a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "explanation",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3821,17 +5786,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -3842,18 +5820,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -3865,17 +5856,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -3887,17 +5891,30 @@
     "description": "A fine-grained personal access token was updated.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3908,15 +5925,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3926,17 +5958,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3946,15 +5989,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3964,17 +6022,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3984,17 +6053,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4004,17 +6084,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4024,17 +6115,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4044,19 +6146,32 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
-      "request_id",
-      "user_agent",
+      "action",
       "actor",
-      "operation_type"
-    ],
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "owner",
+      "operation_type"
+    ],
     "docs_reference_titles": "Personalize your profile"
   },
   {
@@ -4064,17 +6179,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4082,20 +6210,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -4105,25 +6244,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -4131,20 +6282,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4152,25 +6315,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4178,17 +6353,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4196,17 +6384,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4214,18 +6415,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -4234,39 +6447,62 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
-  },
-  {
-    "action": "project.link",
-    "description": "A repository was linked to a project board.",
-    "docs_reference_links": "N/A",
-    "fields": [
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "actor_id",
-      "org_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
+  },
+  {
+    "action": "project.link",
+    "description": "A repository was linked to a project board.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "repo"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4274,17 +6510,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -4296,22 +6545,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -4319,19 +6577,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4339,17 +6608,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4357,18 +6639,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -4376,20 +6671,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4397,18 +6702,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -4417,36 +6734,61 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
-  },
-  {
-    "action": "project.visibility_private",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
+  },
+  {
+    "action": "project.visibility_private",
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -4458,21 +6800,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -4480,18 +6834,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4502,23 +6869,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -4527,24 +6905,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -4553,20 +6942,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4575,21 +6978,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -4599,22 +7015,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4623,25 +7051,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
-      "actor",
-      "key",
-      "fingerprint",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "fingerprint",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4650,23 +7088,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4675,22 +7124,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -4699,21 +7158,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -4722,25 +7190,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -4749,23 +7224,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -4774,24 +7257,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -4800,23 +7290,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -4826,22 +7324,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -4850,19 +7357,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -4871,24 +7391,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -4897,23 +7427,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4924,17 +7463,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -4943,15 +7495,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -4962,16 +7527,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -4981,17 +7559,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -5001,19 +7592,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -5022,17 +7624,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -5041,26 +7656,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -5069,30 +7690,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -5102,20 +7728,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5124,25 +7761,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5151,23 +7796,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5175,25 +7831,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -5203,23 +7868,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -5227,21 +7902,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5249,21 +7934,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -5271,22 +7966,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5294,21 +7998,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -5316,20 +8030,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5337,22 +8062,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5360,18 +8094,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5379,22 +8127,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5402,21 +8160,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5424,18 +8192,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -5444,48 +8224,65 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
-    ],
-    "docs_reference_titles": "Using secrets in GitHub Actions"
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Using secrets in GitHub Actions"
+  },
   {
     "action": "repo.remove_actions_variable",
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5494,23 +8291,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5518,26 +8325,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -5546,21 +8358,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -5569,25 +8390,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5595,22 +8422,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -5619,19 +8456,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5639,23 +8487,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -5665,20 +8522,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -5689,21 +8557,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -5712,22 +8591,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -5736,21 +8625,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -5759,22 +8659,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -5785,16 +8695,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -5803,22 +8724,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -5828,22 +8758,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -5852,23 +8793,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5878,41 +8829,61 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "repo.unarchived",
-    "description": "A repository was unarchived.",
-    "docs_reference_links": "/repositories/archiving-a-github-repository",
-    "fields": [
-      "actor",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "repo",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
+      "visibility"
+    ]
+  },
+  {
+    "action": "repo.unarchived",
+    "description": "A repository was unarchived.",
+    "docs_reference_links": "/repositories/archiving-a-github-repository",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -5921,24 +8892,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5946,25 +8926,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5973,24 +8960,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -5999,25 +8996,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -6026,22 +9031,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6050,26 +9064,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -6077,31 +9099,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6110,21 +9139,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -6132,21 +9171,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6154,21 +9203,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -6176,20 +9236,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6197,21 +9269,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6219,19 +9302,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -6239,31 +9335,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -6272,19 +9376,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -6292,8 +9407,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -6302,23 +9416,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -6343,18 +9466,30 @@
     "description": "A security key was registered for an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6362,18 +9497,30 @@
     "description": "A security key was removed from an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6381,16 +9528,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6400,18 +9560,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -6420,16 +9593,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6440,15 +9626,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -6458,15 +9657,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -6475,17 +9689,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -6494,17 +9721,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -6513,33 +9754,61 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "created_at",
-      "user",
       "_document_id",
-      "user_agent",
-      "actor",
-      "operation_type"
-    ],
-    "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
-  },
-  {
-    "action": "sponsors.sponsor_sponsorship_tier_change",
-    "description": "A sponsorship was upgraded or downgraded.",
-    "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
-    "fields": [
-      "user_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "user",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
+  },
+  {
+    "action": "sponsors.sponsor_sponsorship_tier_change",
+    "description": "A sponsorship was upgraded or downgraded.",
+    "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -6549,17 +9818,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -6568,17 +9850,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -6587,18 +9882,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6607,15 +9915,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -6625,16 +9947,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6642,15 +9977,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -6661,16 +10009,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -6680,17 +10041,30 @@
     "description": "Triggered when you send an email update to your sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
     "fields": [
-      "request_id",
-      "actor",
-      "action",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
   },
@@ -6699,17 +10073,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -6720,17 +10107,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -6741,18 +10141,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6762,16 +10173,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6781,17 +10205,30 @@
     "description": "You join the waitlist to join GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "actor_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -6800,16 +10237,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6819,23 +10269,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6843,23 +10303,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6867,23 +10337,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6891,39 +10371,64 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
-    ]
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
+      "public_repo",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
+    ]
+  },
   {
     "action": "successor_invitation.accept",
     "description": "Triggered when you accept a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6932,15 +10437,30 @@
     "description": "Triggered when you cancel a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6949,15 +10469,30 @@
     "description": "Triggered when you create a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6966,15 +10501,30 @@
     "description": "Triggered when you decline a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6983,15 +10533,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6999,15 +10564,30 @@
     "description": "Triggered when you revoke a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7016,17 +10596,30 @@
     "description": "A new trusted device was added.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7034,17 +10627,30 @@
     "description": "A trusted device was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7052,14 +10658,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "action",
-      "request_id",
-      "user_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -7068,29 +10689,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "created_at",
-      "user_id",
-      "operation_type",
-      "user",
       "_document_id",
-      "user_agent",
-      "action"
-    ]
-  },
-  {
-    "action": "two_factor_account_recovery.ignore",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "two_factor_account_recovery.ignore",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "created_at",
-      "user_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7098,17 +10751,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "operation_type",
-      "action",
-      "_document_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7116,17 +10782,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7134,16 +10813,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7151,15 +10844,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "user",
       "_document_id",
-      "request_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7167,18 +10875,30 @@
     "description": "A secondary authentication factor was added to a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -7187,18 +10907,30 @@
     "description": "Two-factor authentication was disabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
     "fields": [
-      "actor",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_id",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Disabling two-factor authentication for your personal account"
   },
@@ -7207,18 +10939,30 @@
     "description": "Two-factor authentication was enabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
-      "actor",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Configuring two-factor authentication"
   },
@@ -7227,52 +10971,92 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user",
-      "user_id",
-      "action",
       "@timestamp",
-      "request_id",
-      "_document_id",
-      "user_agent"
-    ]
-  },
-  {
-    "action": "two_factor_authentication.recovery_codes_regenerated",
-    "description": "Two factor recovery codes were regenerated for a user account.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
-      "user_id",
       "action",
-      "user",
-      "user_agent",
+      "actor",
       "actor_id",
-      "@timestamp",
-      "created_at"
-    ]
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "two_factor_authentication.recovery_codes_regenerated",
+    "description": "Two factor recovery codes were regenerated for a user account.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "two_factor_authentication.remove_factor",
     "description": "A secondary authentication factor was removed from a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -7281,15 +11065,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "created_at",
-      "_document_id",
-      "action",
-      "@timestamp"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7298,16 +11097,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "operation_type",
       "user_agent",
-      "action",
-      "request_id",
-      "actor",
-      "actor_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7315,19 +11127,31 @@
     "description": "An email address was added to a user account.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "actor_id",
-      "actor",
       "email",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding an email address to your GitHub account"
   },
@@ -7336,18 +11160,30 @@
     "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "created_at",
-      "user",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7355,15 +11191,28 @@
     "description": "Audit log entries were exported.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "action",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ]
@@ -7373,20 +11222,31 @@
     "description": "A user was blocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_id",
-      "_document_id",
       "actor_id",
-      "@timestamp",
-      "user_agent",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7394,18 +11254,30 @@
     "description": "A user changed their password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "actor_id",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7413,18 +11285,30 @@
     "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -7433,17 +11317,30 @@
     "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -7452,19 +11349,31 @@
     "description": "A new user account was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "email",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "created_at",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "programmatic_access_type"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "email",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7472,21 +11381,33 @@
     "description": "A user secret for Codespaces was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7494,20 +11415,31 @@
     "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "oauth_application_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "@timestamp",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -7515,18 +11447,30 @@
     "description": "A user account was destroyed by an asynchronous job.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7535,19 +11479,30 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "oauth_application_id",
+      "_document_id",
       "action",
-      "user",
-      "created_at",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7555,18 +11510,30 @@
     "description": "A user deleted his or her account, triggering user.async_delete.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
-      "created_at",
-      "user_agent",
       "user_id",
-      "operation_type",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7574,18 +11541,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "user_agent",
       "user_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7593,37 +11572,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "actor_id",
+      "_document_id",
       "action",
-      "request_access_security_header"
-    ]
-  },
-  {
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
     "action": "user.device_verification_success",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "request_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7631,17 +11634,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7649,17 +11665,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7667,17 +11696,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7685,21 +11727,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7707,21 +11759,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -7730,17 +11792,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7748,17 +11823,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7766,17 +11854,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7784,36 +11885,62 @@
     "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "org_id",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent"
-    ]
-  },
-  {
-    "action": "user.forgot_password",
-    "description": "A user requested a password reset.",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "user.forgot_password",
+    "description": "A user requested a password reset.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
     "fields": [
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "email",
-      "created_at",
-      "user_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
   },
@@ -7822,17 +11949,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "created_at",
-      "user_agent",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "request_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7840,18 +11980,30 @@
     "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -7860,19 +12012,31 @@
     "description": "A user signed in.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "actor_id",
       "@timestamp",
-      "user",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "actor",
-      "passkey_nickname",
-      "request_access_security_header"
+      "passkey_nickname"
     ]
   },
   {
@@ -7880,18 +12044,30 @@
     "description": "A user signed out.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7899,18 +12075,30 @@
     "description": "A user signed in from a new device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7918,21 +12106,31 @@
     "description": "An ordinary user account was promoted to a site administrator.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
+      "user_id",
       "user_agent",
+      "created_at",
       "oauth_application_id",
-      "request_id",
-      "operation_type",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7940,16 +12138,29 @@
     "description": "A user's account was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user",
-      "action",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "operation_type"
     ]
   },
@@ -7958,20 +12169,31 @@
     "description": "An email address was removed from a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "actor_id",
       "created_at",
-      "email",
-      "token_scopes",
-      "programmatic_access_type"
+      "email"
     ]
   },
   {
@@ -7979,20 +12201,32 @@
     "description": "A user secret for Codespaces was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "key",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8000,20 +12234,31 @@
     "description": "A username was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "request_id",
-      "actor_id",
-      "old_login",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_login",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8021,18 +12266,30 @@
     "description": "A user reset their account password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8040,16 +12297,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -8060,16 +12330,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -8078,18 +12360,30 @@
     "description": "A user signed in from an unrecognized device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor",
-      "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8097,18 +12391,30 @@
     "description": "A user signed in from an unrecognized device and location.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "created_at",
-      "_document_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8116,22 +12422,33 @@
     "description": "Triggered when you clear the status on your profile.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "message",
-      "user",
-      "actor_id",
       "created_at",
-      "request_id",
       "limited_availability",
-      "action",
       "emoji",
-      "operation_type",
-      "user_agent",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8139,23 +12456,33 @@
     "description": "Triggered when you set or change the status on your profile.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
     "fields": [
-      "limited_availability",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "message",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "limited_availability",
+      "message",
+      "created_at",
       "emoji",
-      "org",
-      "actor",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
   },
@@ -8164,21 +12491,31 @@
     "description": "A user account was suspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "user_agent",
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "token_scopes",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8186,18 +12523,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
-      "actor_id",
       "@timestamp",
-      "operation_type",
       "_document_id",
-      "user_agent",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8205,18 +12554,30 @@
     "description": "A 2FA challenge issued for a user account failed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "actor_id",
-      "actor",
-      "user_id",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8226,16 +12587,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
       "user_agent",
-      "request_id",
-      "action",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8243,18 +12616,30 @@
     "description": "A user used their 2FA recovery codes.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8262,18 +12647,30 @@
     "description": "A user downloaded 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8281,17 +12678,30 @@
     "description": "A user printed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8299,18 +12709,30 @@
     "description": "A user viewed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
       "created_at",
-      "user",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8318,17 +12740,30 @@
     "description": "A user was prompted for a two-factor authentication code.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
     "fields": [
-      "user",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "actor"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
   },
@@ -8337,19 +12772,31 @@
     "description": "A user was unblocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "user_agent",
-      "user_id",
-      "user",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8357,21 +12804,31 @@
     "description": "A user account was unsuspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "user_agent",
       "actor",
-      "oauth_application_id",
-      "operation_type",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "user_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8379,21 +12836,33 @@
     "description": "A user secret for Codespaces was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8401,46 +12870,64 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "workflows.approve_workflow_job",
+    "description": "A workflow job was approved.",
+    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "workflows.approve_workflow_job",
-    "description": "A workflow job was approved.",
-    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
-    "fields": [
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "workflow_run_id",
       "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -8449,23 +12936,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8473,23 +12970,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8499,23 +13004,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -8524,22 +13041,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8547,21 +13075,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -8569,25 +13108,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8595,24 +13142,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -8621,25 +13177,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.18/enterprise.json b/src/audit-logs/data/ghes-3.18/enterprise.json
index d1f961217c48..c6071acd7121 100644
--- a/src/audit-logs/data/ghes-3.18/enterprise.json
+++ b/src/audit-logs/data/ghes-3.18/enterprise.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,17 +67,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
-      "user_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -61,18 +98,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
+      "token_scopes",
       "user",
-      "request_id",
-      "_document_id",
-      "user_agent",
-      "actor",
       "user_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -80,18 +129,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "token_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -99,29 +160,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -129,31 +196,34 @@
     "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "query_string",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "request_body",
-      "status_code",
-      "url_path",
       "business",
       "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "request_method",
+      "query_string",
+      "request_body",
+      "status_code",
+      "url_path",
+      "public_repo",
       "created_at",
       "operation_type",
       "route",
@@ -167,18 +237,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -186,20 +268,32 @@
     "description": "A manual check of the endpoint configured for audit log streaming was performed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "audit_log_stream_result",
-      "business_id",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_result",
       "created_at",
       "operation_type",
-      "audit_log_stream_sink_details",
-      "request_access_security_header"
+      "audit_log_stream_sink_details"
     ]
   },
   {
@@ -207,18 +301,31 @@
     "description": "An endpoint was added for audit log streaming.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "business_id",
       "business",
-      "audit_log_stream_sink",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_sink",
+      "created_at",
+      "operation_type",
       "audit_log_stream_id"
     ]
   },
@@ -227,15 +334,28 @@
     "description": "An audit log streaming endpoint was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "business_id",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "audit_log_stream_id",
@@ -247,17 +367,30 @@
     "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "audit_log_stream_enabled",
-      "business_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_enabled",
       "audit_log_stream_sink",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "new_s3_bucket",
@@ -280,17 +413,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -299,19 +445,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -320,18 +478,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -339,18 +510,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -358,15 +541,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -376,22 +572,31 @@
     "description": "An enterprise owner was added to an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
     "fields": [
-      "name",
-      "business",
-      "user",
-      "user_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "request_id",
+      "business",
       "business_id",
-      "_document_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Inviting people to manage your enterprise"
   },
@@ -400,22 +605,32 @@
     "description": "An organization was added to an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "operation_type",
       "name",
       "created_at",
-      "request_id",
-      "_document_id",
-      "business",
-      "organization_upgrade",
-      "request_access_security_header"
+      "organization_upgrade"
     ]
   },
   {
@@ -423,20 +638,30 @@
     "description": "GitHub Advanced Security was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -445,17 +670,28 @@
     "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -466,21 +702,31 @@
     "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -489,17 +735,28 @@
     "description": "GitHub Advanced Security was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -510,17 +767,28 @@
     "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -531,21 +799,31 @@
     "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -554,20 +832,32 @@
     "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "new_policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "new_policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -576,20 +866,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -597,17 +899,28 @@
     "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -619,21 +932,31 @@
     "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -642,18 +965,31 @@
     "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -662,17 +998,30 @@
     "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
     "fields": [
-      "name",
-      "operation_type",
-      "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "actor",
+      "@timestamp",
       "_document_id",
-      "business",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -682,19 +1031,32 @@
     "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
-      "action",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "business",
       "visibility",
       "created_at",
-      "actor",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -703,21 +1065,33 @@
     "description": "The policy for Code scanning autofix was updated for an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -725,21 +1099,33 @@
     "description": "The policy for Code scanning autofix third party tools was updated for an enterprise.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/getting-started/github-security-features#available-with-github-code-security"
   },
@@ -748,18 +1134,30 @@
     "description": "The policy for Code Security enablement was updated for an enterprise.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -771,19 +1169,31 @@
     "description": "An enterprise was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "request_id",
-      "name",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "operation_type",
-      "actor",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -791,17 +1201,28 @@
     "description": "Dependabot alerts were disabled for new repositories in your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -811,17 +1232,28 @@
     "description": "Dependabot alerts were enabled for new repositories in your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -831,17 +1263,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -851,18 +1296,30 @@
     "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -870,17 +1327,28 @@
     "description": "Display of IP addresses within audit log events for the enterprise was disabled.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -891,18 +1359,31 @@
     "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "business_id",
-      "actor_id",
-      "name",
-      "_document_id",
-      "request_id"
+      "name"
     ]
   },
   {
@@ -910,15 +1391,28 @@
     "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -928,17 +1422,28 @@
     "description": "Display of IP addresses within audit log events for the enterprise was enabled.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -949,18 +1454,31 @@
     "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "operation_type",
-      "created_at",
+      "actor_id",
       "business",
       "business_id",
-      "name",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ]
   },
   {
@@ -968,20 +1486,31 @@
     "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
       "business",
-      "name",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "business_id",
-      "_document_id"
+      "created_at",
+      "name",
+      "operation_type"
     ]
   },
   {
@@ -989,20 +1518,31 @@
     "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1010,20 +1550,31 @@
     "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "business",
-      "actor_id",
-      "created_at",
-      "action",
+      "user_id",
       "user_agent",
-      "request_id",
-      "user_id"
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1031,20 +1582,31 @@
     "description": "An enterprise owner was removed from an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
-      "user_agent",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "name",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
-      "user"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ],
     "docs_reference_titles": "Inviting people to manage your enterprise"
   },
@@ -1053,20 +1615,31 @@
     "description": "An organization was removed from an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "business",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "business_id",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "name",
-      "org"
+      "name"
     ]
   },
   {
@@ -1074,18 +1647,31 @@
     "description": "The slug for the enterprise URL was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "name",
-      "business_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
-      "@timestamp",
-      "created_at",
+      "actor_id",
       "business",
-      "_document_id"
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1093,20 +1679,31 @@
     "description": "The SAML single sign-on session for a member in an enterprise was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "_document_id",
-      "actor_id",
       "name",
-      "@timestamp",
-      "user_id",
-      "action",
-      "created_at",
-      "business"
+      "created_at"
     ]
   },
   {
@@ -1114,17 +1711,28 @@
     "description": "Automatic partner validation checks have been disabled at the business level",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1135,17 +1743,28 @@
     "description": "Automatic partner validation checks have been enabled at the business level",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1156,20 +1775,30 @@
     "description": "An enterprise-level custom pattern was created for secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -1178,17 +1807,28 @@
     "description": "An enterprise-level custom pattern was removed from secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1198,20 +1838,30 @@
     "description": "An enterprise-level custom pattern was published for secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1219,17 +1869,28 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1240,20 +1901,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -1262,17 +1933,28 @@
     "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1282,17 +1964,28 @@
     "description": "Secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1303,17 +1996,28 @@
     "description": "Secret scanning was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1324,17 +2028,28 @@
     "description": "Secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1345,17 +2060,28 @@
     "description": "Secret scanning was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1366,17 +2092,28 @@
     "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1388,17 +2125,28 @@
     "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1410,17 +2158,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1431,17 +2190,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1452,17 +2222,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1473,17 +2254,28 @@
     "description": "Push protection for secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1494,17 +2286,28 @@
     "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1515,17 +2318,28 @@
     "description": "Push protection for secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1536,17 +2350,28 @@
     "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1557,20 +2382,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1578,26 +2415,36 @@
     "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1605,24 +2452,34 @@
     "description": "A CSV export was requested on the \"Coverage\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1630,26 +2487,36 @@
     "description": "A CSV export was requested on the \"Overview Dashboard\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1657,20 +2524,31 @@
     "description": "A CSV export was requested on the \"Risk\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1681,17 +2559,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -1702,20 +2593,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1724,40 +2627,65 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
-  },
-  {
-    "action": "business.set_default_workflow_permissions",
-    "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
-    "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
-    "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
+      "limit",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+  },
+  {
+    "action": "business.set_default_workflow_permissions",
+    "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
+    "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1766,20 +2694,32 @@
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1788,19 +2728,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1809,20 +2761,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "issuer",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
       "business_id",
-      "actor_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "issuer",
+      "name",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1830,18 +2794,31 @@
     "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "updated_github_owned_allowed",
       "updated_verified_allowed",
       "updated_patterns",
@@ -1856,20 +2833,33 @@
     "description": "The base repository permission setting was updated for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
     "fields": [
-      "business_id",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "permission",
-      "action",
       "created_at",
-      "@timestamp",
-      "request_id",
       "name",
-      "_document_id",
-      "old_permission",
-      "business"
+      "old_permission"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -1878,19 +2868,32 @@
     "description": "The repository creation setting was updated for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "name",
-      "business_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "operation_type",
-      "permission",
-      "action",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "name",
+      "operation_type",
+      "permission",
       "visibility"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -1900,19 +2903,32 @@
     "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories",
     "fields": [
-      "business_id",
-      "created_at",
-      "action",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "permission",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "business"
+      "created_at",
+      "operation_type",
+      "permission",
+      "name"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -1921,20 +2937,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -1943,20 +2970,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -1967,17 +3005,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1985,15 +3035,31 @@
     "description": "Existing code scanning alerts appeared in a branch.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2003,15 +3069,31 @@
     "description": "Code scanning alerts were fixed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2021,15 +3103,31 @@
     "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_numbers",
       "commit_oid",
-      "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business"
+      "ref"
     ],
     "docs_reference_titles": "About code scanning"
   },
@@ -2038,15 +3136,29 @@
     "description": "Code scanning alerts were manually dismissed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers",
       "dismissal_approver_id"
     ],
@@ -2057,19 +3169,31 @@
     "description": "Dismissal of code scanning alerts was approved.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2080,19 +3204,31 @@
     "description": "Dismissal of code scanning alerts was denied.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2103,19 +3239,31 @@
     "description": "Dismissal of code scanning alerts was requested.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2126,13 +3274,31 @@
     "description": "Code scanning alerts were seen for the first time.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "commit_oid",
-      "ref",
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
+      "commit_oid",
+      "ref",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2142,15 +3308,31 @@
     "description": "Code scanning alerts that were previously fixed reappeared.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2160,15 +3342,29 @@
     "description": "Code scanning alerts that were previously dismissed were reopened.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2178,14 +3374,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2195,25 +3406,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -2224,22 +3444,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -2251,22 +3482,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -2275,15 +3517,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -2294,17 +3551,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2314,27 +3584,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "owner",
-      "pull_request_id",
-      "machine_type",
-      "user_id",
-      "user",
-      "devcontainer_path",
-      "repo",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
+      "machine_type",
+      "devcontainer_path",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2342,19 +3621,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -2362,18 +3654,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -2382,23 +3686,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2406,16 +3717,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -2424,24 +3749,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2449,15 +3780,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2467,20 +3811,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2488,19 +3842,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -2508,21 +3874,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -2530,22 +3905,33 @@
     "description": "Specific repositories were disabled from using Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "owner_type",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -2553,21 +3939,31 @@
     "description": "Specific repositories were enabled to use Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "owner_type",
-      "owner",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2577,20 +3973,32 @@
     "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_access",
       "old_access",
-      "org_id",
       "owner_type",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2600,21 +4008,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2624,19 +4041,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2646,21 +4072,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2670,18 +4105,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -2694,18 +4142,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -2719,14 +4180,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -2739,8 +4215,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2749,27 +4224,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "definition_id",
-      "property_name",
-      "value",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "definition_id",
+      "property_name",
+      "value",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2778,19 +4261,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2799,16 +4294,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "definition_id"
@@ -2820,19 +4328,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -2841,19 +4360,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -2862,19 +4392,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -2883,19 +4424,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -2904,21 +4456,31 @@
     "description": "The default repository access for Dependabot was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "access_level",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -2927,17 +4489,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2945,19 +4520,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -2966,19 +4552,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2986,19 +4583,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -3007,19 +4615,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3027,19 +4646,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -3048,19 +4678,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3068,19 +4709,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -3089,20 +4741,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3110,59 +4772,95 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
       "created_at",
-      "user_id",
-      "@timestamp",
       "number",
-      "org",
       "title",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "discussion_post_reply.destroy",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
       "operation_type",
-      "_document_id"
+      "number",
+      "created_at"
     ]
   },
   {
-    "action": "discussion_post_reply.destroy",
+    "action": "discussion_post_reply.update",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
-      "user_agent",
-      "operation_type",
-      "user_id",
-      "actor",
-      "number",
-      "user",
-      "created_at",
-      "request_id",
-      "_document_id"
-    ]
-  },
-  {
-    "action": "discussion_post_reply.update",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "action",
       "_document_id",
-      "request_id",
-      "org",
-      "@timestamp",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "number",
       "team",
       "created_at"
@@ -3173,21 +4871,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "_document_id",
-      "title",
-      "user",
-      "user_agent",
-      "org",
-      "operation_type",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "team",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type",
+      "team",
       "number"
     ]
   },
@@ -3196,17 +4905,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3217,16 +4940,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3237,18 +4974,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
       "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3259,23 +5010,31 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise"
   },
@@ -3284,19 +5043,33 @@
     "description": "A domain was approved for an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3305,18 +5078,33 @@
     "description": "A domain was added to an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3325,18 +5113,33 @@
     "description": "A domain was removed from an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3345,18 +5148,33 @@
     "description": "A domain was verified for an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3365,18 +5183,30 @@
     "description": "A new GitHub Actions self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -3385,20 +5215,30 @@
     "description": "A GitHub Actions self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -3407,18 +5247,31 @@
     "description": "A GitHub Actions self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
@@ -3428,18 +5281,31 @@
     "description": "A GitHub Actions self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3448,20 +5314,33 @@
     "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -3470,19 +5349,31 @@
     "description": "A GitHub Actions self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3491,19 +5382,32 @@
     "description": "A GitHub Actions runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -3512,24 +5416,36 @@
     "description": "The configuration of a GitHub Actions self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3538,14 +5454,32 @@
     "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -3554,14 +5488,32 @@
     "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -3570,18 +5522,36 @@
     "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
       "target_version",
       "runner_group_id",
       "runner_group_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Self-hosted runners"
   },
@@ -3590,22 +5560,32 @@
     "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "business_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "user",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3613,21 +5593,33 @@
     "description": "A license for GitHub Copilot was assigned to an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3635,17 +5627,30 @@
     "description": "A license for GitHub Copilot was unassigned from an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3656,17 +5661,30 @@
     "description": "A new enterprise team was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3676,17 +5694,30 @@
     "description": "An enterprise team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3697,22 +5728,32 @@
     "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "business_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "user",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3720,18 +5761,31 @@
     "description": "The name of an enterprise team was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "business_id",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3742,46 +5796,65 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "Managing environments for deployment"
-  },
-  {
-    "action": "environment.create",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Managing environments for deployment"
+  },
+  {
+    "action": "environment.create",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3789,28 +5862,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3819,27 +5898,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -3848,25 +5935,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3875,26 +5970,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3903,21 +6005,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -3926,22 +6040,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -3950,49 +6074,70 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "public_repo",
       "programmatic_access_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "Managing environments for deployment"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "visibility",
+      "operation_type",
+      "created_at",
+      "public_repo"
+    ],
+    "docs_reference_titles": "Managing environments for deployment"
   },
   {
     "action": "environment.update_actions_variable",
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -4001,21 +6146,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -4026,27 +6181,33 @@
     "description": "A user was added to an external group.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "external_group",
-      "external_group_id",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "external_group",
+      "external_group_id",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -4054,19 +6215,31 @@
     "description": "An external group was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at",
       "scim_group_id"
     ]
   },
@@ -4075,22 +6248,33 @@
     "description": "An external group was linked to a GitHub team.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "external_group",
-      "programmatic_access_type",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -4098,21 +6282,31 @@
     "description": "An external group was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4120,26 +6314,32 @@
     "description": "A user was removed from an external group.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "external_group",
-      "external_group_id",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "external_group",
+      "external_group_id",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4147,15 +6347,29 @@
     "description": "Failed external group SCIM API request.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
@@ -4163,15 +6377,9 @@
       "url_path",
       "scim_group_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4180,30 +6388,38 @@
     "description": "Successful external group SCIM API request. Excludes GET API requests.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4212,18 +6428,31 @@
     "description": "An external group was unlinked to a GitHub team.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "external_group"
     ]
   },
@@ -4232,22 +6461,32 @@
     "description": "An external group was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "scim_group_id",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at",
+      "scim_group_id"
     ]
   },
   {
@@ -4255,25 +6494,33 @@
     "description": "An external group's display name was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
       "external_group",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -4281,20 +6528,31 @@
     "description": "An external identity was deprovisioned, suspending the linked GitHub user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -4302,17 +6560,31 @@
     "description": "An external identity was created and linked to a GitHub user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "scim_user_id",
-      "request_access_security_header"
+      "scim_user_id"
     ]
   },
   {
@@ -4320,15 +6592,29 @@
     "description": "Failed external identity SCIM API request.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
@@ -4336,15 +6622,9 @@
       "url_path",
       "scim_user_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4353,30 +6633,38 @@
     "description": "Successful external identity SCIM API request. Excludes GET API requests.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4385,18 +6673,31 @@
     "description": "An external identity was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "scim_user_id",
-      "request_access_security_header"
+      "scim_user_id"
     ]
   },
   {
@@ -4404,21 +6705,32 @@
     "description": "A gist was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "gist_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "visibility",
-      "action",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ]
   },
   {
@@ -4426,20 +6738,32 @@
     "description": "A gist was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "gist_id",
-      "visibility",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "user",
-      "request_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "programmatic_access_type"
+      "gist_id",
+      "visibility",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4447,21 +6771,32 @@
     "description": "The visibility of a gist was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "user",
-      "gist_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "visibility",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "gist_id",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -4469,19 +6804,30 @@
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4490,20 +6836,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4512,19 +6868,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4533,22 +6900,33 @@
     "description": "An SSH key was added to a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -4557,23 +6935,34 @@
     "description": "An SSH key was removed from a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
       "explanation",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -4582,23 +6971,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4606,18 +7004,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4628,20 +7036,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -4651,18 +7069,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "user",
-      "operation_type",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4670,18 +7100,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4689,25 +7131,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -4715,25 +7167,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -4741,26 +7202,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -4769,25 +7239,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -4795,26 +7274,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -4822,21 +7310,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -4845,19 +7344,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -4865,21 +7377,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -4888,19 +7411,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -4911,20 +7448,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -4934,24 +7483,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -4962,23 +7522,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -4989,21 +7561,33 @@
     "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
       "operation_type",
-      "@timestamp",
       "integration",
-      "action",
-      "user_agent",
       "reason",
-      "_document_id",
-      "org",
-      "org_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -5014,20 +7598,32 @@
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
       "@timestamp",
-      "actor_id",
-      "org",
       "_document_id",
-      "requester",
       "action",
-      "user_agent",
-      "created_at",
-      "url",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "requester",
+      "created_at",
+      "url",
+      "operation_type",
       "integration",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -5037,20 +7633,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -5060,19 +7669,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -5081,20 +7704,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -5104,20 +7740,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -5126,20 +7775,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -5148,20 +7810,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5169,19 +7843,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -5190,19 +7877,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -5211,17 +7911,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -5234,21 +7947,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -5262,17 +7988,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -5284,19 +8023,30 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "user"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5304,19 +8054,30 @@
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5324,17 +8085,28 @@
     "description": "IP allow list user level enforcement was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5344,20 +8116,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "user_id",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
-      "_document_id",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "actor_id",
       "operation_type",
-      "org",
       "created_at"
     ]
   },
@@ -5366,19 +8147,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5386,17 +8178,28 @@
     "description": "IP allow list user level enforcement was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5406,24 +8209,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5431,24 +8242,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "ip_allow_list_entry",
-      "org",
-      "operation_type",
-      "created_at",
-      "active",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at",
+      "active"
     ]
   },
   {
@@ -5456,19 +8275,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "actor_id",
       "ip_allow_list_entry",
-      "active",
-      "org_id",
-      "@timestamp"
+      "active"
     ]
   },
   {
@@ -5476,18 +8308,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5495,21 +8339,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -5517,21 +8374,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5539,22 +8409,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -5562,19 +8445,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -5585,21 +8481,36 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
       "marketplace_listing",
       "has_free_trial",
-      "user_agent",
-      "request_id",
-      "actor_id",
       "yearly_price_in_cents",
       "description",
       "bullets",
       "monthly_price_in_cents",
-      "marketplace_listing_plan",
-      "_document_id"
+      "marketplace_listing_plan"
     ]
   },
   {
@@ -5607,22 +8518,37 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "marketplace_listing_plan",
       "marketplace_listing",
       "description",
       "bullets",
       "has_free_trial",
       "created_at",
-      "actor_id",
       "operation_type",
-      "_document_id",
-      "action",
-      "user_agent",
-      "request_id",
-      "actor",
       "monthly_price_in_cents",
-      "yearly_price_in_cents",
-      "@timestamp"
+      "yearly_price_in_cents"
     ]
   },
   {
@@ -5630,21 +8556,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "marketplace_listing_plan",
-      "_document_id",
-      "request_id",
-      "description",
-      "yearly_price_in_cents",
       "@timestamp",
-      "created_at",
-      "actor_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "marketplace_listing_plan",
+      "description",
+      "yearly_price_in_cents",
+      "created_at",
       "bullets",
       "has_free_trial",
       "marketplace_listing",
-      "user_agent",
       "monthly_price_in_cents",
-      "action",
       "operation_type"
     ]
   },
@@ -5653,21 +8594,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "monthly_price_in_cents",
-      "marketplace_listing",
+      "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "monthly_price_in_cents",
+      "marketplace_listing",
       "description",
       "bullets",
       "yearly_price_in_cents",
-      "request_id",
-      "actor_id",
       "has_free_trial",
       "marketplace_listing_plan",
-      "user_agent",
-      "@timestamp",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -5676,22 +8632,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -5699,22 +8668,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5722,19 +8704,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5742,21 +8736,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5766,16 +8769,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5785,18 +8801,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5806,14 +8835,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5821,19 +8866,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5841,18 +8897,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5860,23 +8928,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -5884,20 +8960,30 @@
     "description": "An OAuth access token was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
     "fields": [
-      "_document_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "user",
-      "user_id",
-      "created_at",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "request_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
@@ -5908,19 +8994,30 @@
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "explanation",
-      "hashed_token",
-      "actor_id",
-      "token_scopes",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
@@ -5930,19 +9027,30 @@
     "description": "An OAuth access token was regenerated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "_document_id",
-      "created_at",
       "@timestamp",
-      "operation_type",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ]
   },
@@ -5951,16 +9059,28 @@
     "description": "An OAuth access token was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "request_access_security_header",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
       "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5970,18 +9090,30 @@
     "description": "An OAuth access token was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5989,20 +9121,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6011,42 +9155,66 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
+    ],
+    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
   {
     "action": "oauth_application.generate_client_secret",
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6055,20 +9223,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6077,19 +9257,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6098,20 +9291,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6120,20 +9325,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6143,18 +9360,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "org_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "oauth_application_id",
-      "action",
       "created_at",
-      "actor",
-      "actor_id",
-      "oauth_application",
-      "_document_id",
-      "request_id"
+      "oauth_application"
     ]
   },
   {
@@ -6162,19 +9392,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6183,15 +9426,32 @@
     "description": "An OAuth application was unsuspended for a user or organization account.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "operation_type",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "oauth_application_id",
       "oauth_application",
-      "org",
-      "created_at",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6200,26 +9460,33 @@
     "description": "An authorization for an OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "user_id",
-      "actor",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
       "actor_id",
-      "user",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "oauth_application_name"
-    ],
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "actor_is_bot",
+      "oauth_application_name"
+    ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
   },
   {
@@ -6227,20 +9494,31 @@
     "description": "An authorization for an OAuth application was deleted.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "actor",
       "created_at",
       "explanation",
-      "user",
-      "user_id",
-      "org_id",
-      "action",
-      "actor_id",
-      "token_scopes",
       "actor_is_bot",
       "oauth_application_name"
     ],
@@ -6251,20 +9529,31 @@
     "description": "An authorization for an OAuth application was updated.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
-      "actor_id",
       "user_agent",
-      "@timestamp",
       "operation_type",
-      "action",
-      "user",
       "created_at",
-      "_document_id",
       "actor_is_bot",
-      "request_access_security_header",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -6274,17 +9563,28 @@
     "description": "An invitation sent to an organization to join an enterprise was accepted.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6295,20 +9595,30 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
   },
@@ -6317,21 +9627,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -6340,24 +9660,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6365,21 +9695,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -6387,20 +9727,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6408,43 +9758,61 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "token_scopes"
-    ]
-  },
-  {
-    "action": "org.advanced_security_enabled_for_new_repos",
-    "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "org.advanced_security_enabled_for_new_repos",
+    "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6452,22 +9820,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6475,21 +9851,31 @@
     "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "new_policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -6499,19 +9885,30 @@
     "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -6520,19 +9917,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -6542,16 +9950,29 @@
     "description": "A user initiated a background job to delete an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ]
   },
@@ -6560,16 +9981,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -6578,18 +10012,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
-      "actor",
-      "user_agent",
-      "org_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "blocked_user",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -6598,19 +10045,30 @@
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -6620,22 +10078,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "org_id",
-      "request_id",
-      "email",
       "@timestamp",
-      "actor",
+      "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "email",
+      "operation_type",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -6643,19 +10112,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -6663,23 +10143,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6687,21 +10175,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6709,23 +10207,31 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6733,23 +10239,31 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6757,21 +10271,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -6780,21 +10303,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -6803,16 +10335,29 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
@@ -6822,17 +10367,30 @@
     "description": "The interaction limit for prior contributors only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6841,17 +10399,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6861,16 +10432,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6879,17 +10463,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6898,17 +10495,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -6917,22 +10527,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -6941,17 +10559,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6962,18 +10591,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
-      "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -6982,18 +10623,30 @@
     "description": "An organization was deleted by a user or staff.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "org_id",
-      "org",
       "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7001,20 +10654,30 @@
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -7023,19 +10686,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -7044,14 +10718,31 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "sso_url",
-      "issuer",
-      "action",
       "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "issuer",
+      "created_at",
       "operation_type"
     ]
   },
@@ -7060,17 +10751,30 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7078,19 +10782,30 @@
     "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7098,19 +10813,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
-      "action",
-      "actor_id",
-      "org_id"
+      "created_at"
     ]
   },
   {
@@ -7118,19 +10844,30 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -7139,19 +10876,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -7160,19 +10908,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "sso_url",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "issuer",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "sso_url",
+      "created_at",
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -7181,17 +10942,30 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
   },
@@ -7200,17 +10974,30 @@
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -7219,42 +11006,64 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
-      "org",
-      "user_agent",
-      "request_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "manager",
-      "operation_type",
-      "created_at",
-      "_document_id"
-    ]
-  },
-  {
-    "action": "org.invite_member",
-    "description": "A new user was invited to join an organization.",
-    "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
-    "fields": [
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_id",
-      "invitation_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
+      "user_agent",
+      "manager",
       "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "org.invite_member",
+    "description": "A new user was invited to join an organization.",
+    "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -7263,17 +11072,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7283,19 +11103,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7303,19 +11134,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7324,16 +11166,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7341,17 +11196,30 @@
     "description": "An organization was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7359,19 +11227,31 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -7380,18 +11260,29 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
@@ -7401,21 +11292,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7423,21 +11323,30 @@
     "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user",
-      "org_id",
-      "created_at",
-      "request_id",
       "@timestamp",
-      "action",
-      "operation_type",
-      "user_agent",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7445,21 +11354,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -7467,18 +11386,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -7487,19 +11418,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
-      "old_login",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_login",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7507,20 +11450,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -7529,21 +11482,33 @@
     "description": "A self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -7553,21 +11518,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7576,23 +11551,33 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -7601,23 +11586,31 @@
     "description": "A self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7626,19 +11619,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -7647,25 +11653,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7674,21 +11691,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7698,21 +11724,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7722,20 +11757,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7744,22 +11789,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7768,21 +11821,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7791,21 +11853,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7814,22 +11885,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7838,21 +11917,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7861,21 +11949,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7885,21 +11982,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7909,19 +12015,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7931,21 +12048,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7955,21 +12081,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7979,19 +12114,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -8001,22 +12147,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8025,22 +12179,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8049,22 +12211,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8073,21 +12243,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8096,21 +12275,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8119,22 +12307,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8143,22 +12339,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8167,26 +12371,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8195,26 +12408,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8222,28 +12443,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8251,26 +12480,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8278,15 +12515,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -8295,26 +12549,64 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
-      "org",
-      "runner_id",
-      "runner_name",
-      "action",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "@timestamp"
-    ],
-    "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
-  },
-  {
-    "action": "org.self_hosted_runner_updated",
-    "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
-    "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
-    "fields": [
-      "org_id",
-      "runner_id",
-      "runner_name",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_id",
+      "runner_name",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
+  },
+  {
+    "action": "org.self_hosted_runner_updated",
+    "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
+    "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_id",
+      "runner_name",
       "source_version",
       "target_version",
       "runner_group_id",
@@ -8327,20 +12619,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -8349,16 +12652,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -8369,18 +12685,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -8389,17 +12718,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8407,18 +12749,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -8427,18 +12781,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -8447,18 +12814,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -8467,42 +12846,64 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
-      "org",
-      "issuer",
       "business",
-      "operation_type",
-      "created_at",
-      "request_id",
       "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "org.transform",
-    "description": "A user account was converted into an organization.",
-    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization",
-    "fields": [
-      "actor",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "issuer",
       "operation_type",
+      "created_at",
+      "actor_is_bot"
+    ]
+  },
+  {
+    "action": "org.transform",
+    "description": "A user account was converted into an organization.",
+    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "@timestamp",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "owner",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "owner"
     ],
     "docs_reference_titles": "Converting a user into an organization"
   },
@@ -8511,19 +12912,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
-      "oauth_application_id",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "blocked_user",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -8532,23 +12946,34 @@
     "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -8557,20 +12982,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -8579,20 +13016,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -8600,17 +13048,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -8620,20 +13081,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -8642,19 +13114,32 @@
     "description": "An organization's SAML provider settings were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "issuer",
-      "org",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -8662,19 +13147,31 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "operation_type",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
-    ],
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
   {
@@ -8682,20 +13179,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "org_id",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -8704,16 +13214,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8722,14 +13247,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -8740,16 +13280,31 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "operation_type",
-      "domain_name",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
       "_document_id",
-      "actor_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "domain_name",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8758,20 +13313,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -8781,23 +13347,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8806,21 +13383,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -8831,21 +13419,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8854,20 +13455,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8876,17 +13491,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
-      "owner_type",
-      "domain",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
+      "owner_type",
+      "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8897,20 +13527,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8919,19 +13563,31 @@
     "description": "A new passkey was added.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8939,19 +13595,31 @@
     "description": "A new passkey was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8959,18 +13627,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8978,16 +13658,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8995,18 +13689,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9014,18 +13720,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9036,22 +13755,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9059,22 +13787,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9082,18 +13819,28 @@
     "description": "The configured restriction for access to resources via personal access tokens was reset and delegated to organizations.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9104,18 +13851,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9126,18 +13886,28 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9148,18 +13918,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9170,18 +13950,28 @@
     "description": "Triggered when the enterprise delegates to the organizations when to require approval for fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9192,17 +13982,30 @@
     "description": "Triggered when you create a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9212,19 +14015,31 @@
     "description": "Triggered when you regenerate a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9232,12 +14047,29 @@
     "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
     "fields": [
-      "user_programmatic_access_name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
       "operation_type"
     ],
@@ -9248,20 +14080,32 @@
     "description": "Triggered when you delete a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "explanation",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9269,23 +14113,34 @@
     "description": "A personal access token expiration limit was set.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "token_expiration",
       "old_token_expiration",
       "exempt_administrators",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9293,21 +14148,32 @@
     "description": "A personal access token expiration limit was unset.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "programmatic_access_type",
-      "old_token_expiration",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_token_expiration",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9315,17 +14181,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9336,18 +14215,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9359,17 +14251,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9381,17 +14286,30 @@
     "description": "A fine-grained personal access token was updated.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9402,15 +14320,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9420,17 +14353,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9440,15 +14384,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9458,17 +14417,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9478,17 +14448,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9498,17 +14479,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9518,17 +14510,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9538,17 +14541,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -9558,17 +14574,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9576,20 +14605,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -9599,25 +14639,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -9625,20 +14677,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9646,25 +14710,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9672,17 +14748,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9690,17 +14779,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9708,18 +14810,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -9728,18 +14842,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -9748,19 +14874,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -9768,17 +14905,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -9790,22 +14940,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -9813,19 +14972,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9833,17 +15003,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9851,18 +15034,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -9870,20 +15066,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9891,18 +15097,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -9911,18 +15129,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -9931,16 +15161,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -9952,21 +15195,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -9974,22 +15229,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -9998,29 +15263,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10028,24 +15298,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "repo_id",
-      "user_id",
       "@timestamp",
-      "user_agent",
-      "repo",
-      "name",
-      "org_id",
-      "user",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -10056,21 +15334,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -10081,22 +15369,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10104,24 +15402,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "authorized_actors_only",
       "authorized_actors",
       "created_at",
-      "user_agent",
       "name",
-      "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
-      "actor_id",
-      "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -10129,30 +15437,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -10162,28 +15477,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -10194,23 +15517,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -10218,22 +15550,32 @@
     "description": "Branch deletion was enabled or disabled for a protected branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "operation_type",
-      "request_id",
-      "repo",
       "@timestamp",
-      "org_id",
-      "org",
-      "action",
-      "allow_deletions_enforcement_level",
       "_document_id",
-      "created_at",
-      "actor_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_deletions_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10241,23 +15583,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "actor_id",
-      "name",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo",
-      "operation_type",
-      "request_id",
-      "allow_force_pushes_enforcement_level",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_force_pushes_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10265,24 +15616,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -10291,22 +15651,32 @@
     "description": "Required linear commit history was enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "operation_type",
       "actor",
-      "linear_history_requirement_enforcement_level",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "linear_history_requirement_enforcement_level",
       "name",
-      "org_id",
-      "repo_id",
-      "org",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -10314,24 +15684,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "lock_allows_fetch_and_merge",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "lock_allows_fetch_and_merge",
+      "public_repo",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10340,27 +15719,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10369,18 +15755,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -10391,24 +15790,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -10416,25 +15824,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -10442,22 +15857,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -10465,22 +15890,33 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
   },
@@ -10489,22 +15925,32 @@
     "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "required_approving_review_count",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10512,48 +15958,65 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "protected_branch.update_signature_requirement_enforcement_level",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
+    ]
+  },
+  {
+    "action": "protected_branch.update_signature_requirement_enforcement_level",
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
       "action",
       "actor",
       "actor_id",
-      "signature_requirement_enforcement_level",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "programmatic_access_type"
+      "operation_type",
+      "name",
+      "created_at",
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -10561,22 +16024,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "created_at",
-      "repo_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "name",
-      "actor",
-      "repo",
       "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
+      "strict_required_status_checks_policy"
     ]
   },
   {
@@ -10584,23 +16057,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -10609,24 +16093,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -10635,20 +16130,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10657,21 +16166,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -10681,22 +16203,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10705,25 +16239,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10732,23 +16276,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
-      "created_at",
-      "key",
-      "fingerprint",
-      "actor_id",
       "actor",
-      "title",
-      "user_agent",
-      "user_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "read_only",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "key",
+      "fingerprint",
+      "title",
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10757,18 +16312,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -10778,21 +16347,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -10801,19 +16381,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -10824,23 +16417,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -10850,17 +16455,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -10868,19 +16487,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -10888,19 +16520,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -10910,21 +16555,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -10933,27 +16589,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
-      "pull_request_url",
-      "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
+      "pull_request_url",
+      "pull_request_title",
+      "public_repo",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -10961,23 +16624,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -10986,18 +16661,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -11005,19 +16694,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -11027,20 +16728,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
-      "repo",
-      "created_at",
-      "request_id",
-      "comment_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "comment_id",
+      "operation_type"
     ]
   },
   {
@@ -11048,18 +16760,31 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "_document_id",
-      "@timestamp",
-      "comment_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "comment_id"
     ]
   },
   {
@@ -11067,21 +16792,33 @@
     "description": "A review on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -11089,20 +16826,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -11111,19 +16861,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -11133,23 +16897,33 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "created_at",
-      "user_agent",
-      "actor",
-      "action",
-      "repo",
-      "visibility",
       "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
-    ],
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility",
+      "previous_visibility"
+    ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
   {
@@ -11157,21 +16931,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -11180,25 +16963,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -11207,23 +16997,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -11232,24 +17030,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -11258,23 +17063,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -11284,22 +17097,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -11308,19 +17130,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11329,24 +17164,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -11355,24 +17200,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11380,24 +17233,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11405,24 +17266,32 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11430,24 +17299,32 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11455,23 +17332,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11482,17 +17368,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -11502,17 +17400,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -11522,25 +17432,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11549,26 +17465,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11577,25 +17501,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "query_suite",
-      "threat_model",
-      "languages",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "query_suite",
+      "threat_model",
+      "languages",
+      "public_repo",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -11605,20 +17538,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "visibility",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11626,17 +17570,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11645,15 +17602,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -11664,16 +17634,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11683,17 +17666,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11703,19 +17699,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11724,17 +17731,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11743,26 +17763,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -11771,30 +17797,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
-      "repo",
-      "user_id",
-      "visibility",
-      "repo_id",
-      "user",
-      "request_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_category",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "org",
-      "oauth_application_id",
-      "org_id",
-      "request_method",
+      "actor_id",
       "business",
       "business_id",
-      "public_repo",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "request_category",
+      "created_at",
+      "oauth_application_id",
+      "request_method",
+      "public_repo",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -11804,20 +17835,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -11826,25 +17868,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -11853,23 +17903,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11877,25 +17938,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -11905,17 +17975,30 @@
     "description": "A repository was archived on disk.",
     "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
-      "repo_id",
-      "actor",
       "action",
-      "user_agent"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository/archiving-repositories"
   },
@@ -11924,23 +18007,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -11950,62 +18042,95 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "visibility",
-      "repo_id",
-      "created_at",
-      "actor",
-      "action",
-      "@timestamp",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id"
-    ]
-  },
-  {
-    "action": "repo.noindex",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "visibility",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "actor_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "actor",
-      "user_agent",
-      "repo",
       "user_id",
-      "public_repo"
+      "user_agent",
+      "operation_type",
+      "visibility",
+      "created_at"
     ]
   },
   {
-    "action": "repo.override_unlock",
-    "description": "The repository was unlocked.",
+    "action": "repo.noindex",
+    "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
       "operation_type",
+      "public_repo"
+    ]
+  },
+  {
+    "action": "repo.override_unlock",
+    "description": "The repository was unlocked.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "created_at",
-      "_document_id"
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12013,20 +18138,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "action",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "operation_type",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "visibility",
-      "actor",
-      "user_id"
+      "visibility"
     ]
   },
   {
@@ -12034,23 +18170,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -12058,21 +18204,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12080,21 +18236,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -12102,22 +18268,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -12125,21 +18300,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -12147,20 +18332,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -12168,22 +18364,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12191,18 +18396,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -12210,22 +18429,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -12233,21 +18462,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12255,18 +18494,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -12275,22 +18526,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12299,24 +18559,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12325,23 +18593,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12349,26 +18627,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -12377,21 +18660,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -12400,25 +18692,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12426,22 +18724,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -12450,20 +18758,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "visibility",
-      "operation_type",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "@timestamp",
-      "request_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -12471,19 +18790,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12491,17 +18821,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12510,17 +18855,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12529,7 +18889,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -12544,46 +18925,66 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "public_repo"
-    ],
-    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
-  },
-  {
-    "action": "repo.set_actions_private_fork_pr_approvals_policy",
-    "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
-    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
+      "created_at",
+      "operation_type",
+      "public_repo"
+    ],
+    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
+  },
+  {
+    "action": "repo.set_actions_private_fork_pr_approvals_policy",
+    "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
+    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -12594,21 +18995,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -12617,22 +19029,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -12641,21 +19063,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -12664,22 +19097,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -12690,16 +19133,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -12708,22 +19162,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -12733,22 +19196,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -12757,23 +19231,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12783,19 +19267,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -12803,21 +19297,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -12826,24 +19330,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -12851,25 +19364,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12878,24 +19398,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12904,25 +19434,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12931,22 +19469,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12955,26 +19502,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12982,31 +19537,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "created_at",
-      "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
-      "operation_type",
-      "request_id",
-      "org_id",
       "actor_id",
-      "visibility",
-      "old_permission",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "visibility",
+      "old_permission",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13015,24 +19577,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -13041,24 +19609,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -13067,25 +19641,31 @@
     "description": "Code security was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13094,25 +19674,31 @@
     "description": "Code security was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13121,21 +19707,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -13143,21 +19739,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13165,21 +19771,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -13187,20 +19804,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -13208,21 +19837,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13230,19 +19870,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -13250,31 +19903,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -13283,19 +19944,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -13303,8 +19975,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -13313,23 +19984,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -13354,26 +20034,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -13382,26 +20068,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -13410,23 +20102,30 @@
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13436,23 +20135,30 @@
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13462,24 +20168,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13489,24 +20202,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -13515,24 +20235,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13542,23 +20269,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13568,23 +20302,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13593,22 +20335,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13616,24 +20366,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -13642,24 +20400,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -13668,19 +20434,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13689,24 +20467,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13715,24 +20501,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13741,19 +20535,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13762,26 +20568,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13790,26 +20601,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13818,28 +20634,36 @@
     "description": "A code security configuration was applied to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13847,27 +20671,35 @@
     "description": "A code security configuration failed to attach to the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13875,28 +20707,36 @@
     "description": "A code security configuration was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13904,28 +20744,36 @@
     "description": "A code security configuration was removed due to a change in repository or enterprise settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "security_configuration_id",
-      "security_configuration_name",
-      "repository_security_configuration_state",
-      "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "security_configuration_id",
+      "security_configuration_name",
+      "repository_security_configuration_state",
+      "repository_security_configuration_failure_reason",
+      "public_repo",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -13933,29 +20781,37 @@
     "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -13964,29 +20820,37 @@
     "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -13995,19 +20859,32 @@
     "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
-      "operation_type",
-      "request_id",
-      "repo_id",
       "@timestamp",
-      "user_agent",
-      "alert_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "alert_id",
+      "created_at",
+      "alert_number"
     ],
     "docs_reference_titles": "About Dependabot alerts"
   },
@@ -14016,23 +20893,32 @@
     "description": "A Dependabot alert was manually dismissed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "alert_id",
-      "actor",
-      "repo",
       "created_at",
-      "org",
-      "_document_id",
-      "action",
-      "actor_id",
       "dismiss_reason",
-      "user",
       "dismiss_comment",
       "alert_number",
       "actor_is_bot"
@@ -14043,21 +20929,33 @@
     "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "public_repo",
       "owner",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "token_scopes",
       "alert_number"
     ]
   },
@@ -14066,26 +20964,34 @@
     "description": "A Dependabot alert was manually reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo",
-      "alert_number",
-      "request_access_security_header"
+      "alert_number"
     ]
   },
   {
@@ -14093,21 +20999,32 @@
     "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "alert_id",
-      "repo",
-      "operation_type",
-      "action",
-      "repo_id",
-      "_document_id",
-      "user_agent",
-      "request_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "operation_type",
+      "created_at",
+      "alert_number"
     ]
   },
   {
@@ -14115,21 +21032,35 @@
     "description": "A Dependabot alert was withdrawn.",
     "docs_reference_links": "N/A",
     "fields": [
-      "alert_id",
-      "alert_number",
-      "ghsa_id",
-      "created_at",
-      "active",
+      "@timestamp",
+      "_document_id",
       "action",
-      "repository_id",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "owner",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "alert_number",
+      "ghsa_id",
+      "created_at",
+      "active",
+      "public_repo",
+      "owner",
       "operation_type"
     ]
   },
@@ -14138,20 +21069,30 @@
     "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
     "fields": [
-      "org",
+      "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
-      "operation_type",
-      "created_at",
-      "actor",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
   },
@@ -14160,24 +21101,31 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -14185,26 +21133,32 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14212,23 +21166,30 @@
     "description": "Dependabot alerts was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "request_id",
-      "repo_id",
-      "action",
-      "actor_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "_document_id",
       "user_id",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14236,23 +21197,30 @@
     "description": "Dependabot alerts was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_agent",
-      "created_at",
       "@timestamp",
-      "repo_id",
+      "_document_id",
       "action",
-      "user",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor_id",
-      "_document_id",
-      "user_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -14261,18 +21229,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -14281,19 +21262,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -14302,14 +21295,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -14323,22 +21330,32 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "public_repo",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
@@ -14347,28 +21364,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -14376,25 +21402,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -14402,14 +21435,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -14426,19 +21473,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14447,19 +21505,30 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14468,20 +21537,30 @@
     "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14490,19 +21569,30 @@
     "description": "Secret scanning was enabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14511,14 +21601,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -14536,25 +21640,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14563,25 +21675,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -14591,25 +21711,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -14618,22 +21746,35 @@
     "description": "A secret scanning scan has completed on this repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "repo_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "source",
       "type",
       "source_slug",
       "type_slug",
       "started_at",
       "completed_at",
-      "repo",
       "public_repo",
-      "org",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "secret_types",
@@ -14647,10 +21788,28 @@
     "description": "A security configuration was created",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -14665,15 +21824,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14691,22 +21843,33 @@
     "description": "A default security configuration setting for new repositories was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14715,22 +21878,33 @@
     "description": "A default security configuration setting for new repositories was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14739,10 +21913,28 @@
     "description": "A security configuration was deleted",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -14757,15 +21949,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14782,15 +21967,30 @@
     "description": "A security configuration policy was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enforcement",
       "security_configuration_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14800,10 +22000,28 @@
     "description": "A security configuration was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -14818,15 +22036,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -14844,18 +22055,30 @@
     "description": "A security key was registered for an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14863,18 +22086,30 @@
     "description": "A security key was removed from an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14882,16 +22117,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14901,18 +22149,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -14921,16 +22182,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -14941,15 +22215,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -14959,15 +22246,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -14976,17 +22278,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -14995,17 +22310,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -15014,16 +22343,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -15033,14 +22375,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
-      "actor",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -15050,17 +22407,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -15069,17 +22439,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -15088,18 +22471,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15108,15 +22504,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -15126,16 +22536,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15143,15 +22566,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -15162,16 +22598,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -15181,17 +22630,30 @@
     "description": "Triggered when you send an email update to your sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
     "fields": [
-      "request_id",
-      "actor",
-      "action",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
   },
@@ -15200,17 +22662,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -15221,17 +22696,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -15242,18 +22730,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15263,16 +22762,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15282,17 +22794,30 @@
     "description": "You join the waitlist to join GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "actor_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -15301,16 +22826,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15322,17 +22860,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15341,19 +22892,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15362,21 +22926,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "user",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
       "action",
-      "user_id",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "actor_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15385,19 +22958,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15406,20 +22990,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15427,18 +23025,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -15446,16 +23059,31 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "domain_name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15463,23 +23091,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15487,23 +23125,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15511,23 +23159,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15535,23 +23193,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15559,15 +23227,30 @@
     "description": "Triggered when you accept a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -15576,15 +23259,30 @@
     "description": "Triggered when you cancel a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -15593,15 +23291,30 @@
     "description": "Triggered when you create a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -15610,15 +23323,30 @@
     "description": "Triggered when you decline a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -15627,15 +23355,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15643,15 +23386,30 @@
     "description": "Triggered when you revoke a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -15660,21 +23418,31 @@
     "description": "A member of an organization was added to a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
-      "user",
       "@timestamp",
-      "actor_id",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "org",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -15684,22 +23452,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -15708,20 +23485,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -15730,18 +23518,31 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
       "created_at",
       "operation_type",
-      "actor_id",
-      "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
@@ -15751,21 +23552,32 @@
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -15774,21 +23586,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -15797,40 +23619,63 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "team",
-      "org_id",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "_document_id",
-      "programmatic_access_type",
-      "team_type"
-    ]
-  },
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type",
+      "team_type"
+    ]
+  },
   {
     "action": "team_discussions.clear",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
       "business",
-      "action",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15838,19 +23683,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "request_id",
       "actor",
-      "org",
-      "created_at",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15858,18 +23714,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
       "@timestamp",
-      "action",
       "_document_id",
-      "user_agent",
-      "user_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -15878,22 +23745,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -15902,22 +23778,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -15927,21 +23812,31 @@
     "description": "A repository was removed from a team's control.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "org",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -15949,21 +23844,32 @@
     "description": "A team's name was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "user_agent",
-      "created_at",
-      "team",
-      "operation_type",
-      "actor_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -15972,17 +23878,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -15991,49 +23910,69 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_id",
-      "action",
-      "_document_id"
-    ],
-    "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
-  },
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
+  },
   {
     "action": "team.update_repository_permission",
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
       "operation_type",
       "created_at",
-      "user_agent",
       "permission",
       "new_repo_permission",
       "new_repo_base_role",
       "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_repo_base_role"
     ]
   },
   {
@@ -16041,17 +23980,30 @@
     "description": "A new trusted device was added.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16059,17 +24011,30 @@
     "description": "A trusted device was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16077,14 +24042,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "action",
-      "request_id",
-      "user_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -16093,15 +24073,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "created_at",
-      "user_id",
-      "operation_type",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16109,13 +24104,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "created_at",
-      "user_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16123,17 +24135,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "operation_type",
-      "action",
-      "_document_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16141,17 +24166,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16159,16 +24197,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16176,34 +24228,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "user",
       "_document_id",
-      "request_id"
-    ]
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "two_factor_authentication.add_factor",
     "description": "A secondary authentication factor was added to a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -16212,18 +24291,30 @@
     "description": "Two-factor authentication was disabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
     "fields": [
-      "actor",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_id",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Disabling two-factor authentication for your personal account"
   },
@@ -16232,18 +24323,30 @@
     "description": "Two-factor authentication was enabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
-      "actor",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Configuring two-factor authentication"
   },
@@ -16252,15 +24355,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user",
-      "user_id",
-      "action",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "user_agent"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16268,16 +24386,29 @@
     "description": "Two factor recovery codes were regenerated for a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
+      "operation_type",
       "created_at"
     ]
   },
@@ -16286,18 +24417,30 @@
     "description": "A secondary authentication factor was removed from a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -16306,15 +24449,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "created_at",
-      "_document_id",
-      "action",
-      "@timestamp"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16323,16 +24481,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "operation_type",
       "user_agent",
-      "action",
-      "request_id",
-      "actor",
-      "actor_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16340,19 +24511,31 @@
     "description": "An email address was added to a user account.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "actor_id",
-      "actor",
       "email",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding an email address to your GitHub account"
   },
@@ -16361,34 +24544,59 @@
     "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "created_at",
-      "user",
       "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
       "action",
-      "request_access_security_header"
-    ]
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
   },
   {
     "action": "user.audit_log_export",
     "description": "Audit log entries were exported.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "action",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ]
@@ -16398,20 +24606,31 @@
     "description": "A user was blocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_id",
-      "_document_id",
       "actor_id",
-      "@timestamp",
-      "user_agent",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -16419,18 +24638,30 @@
     "description": "A user changed their password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "actor_id",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16438,18 +24669,30 @@
     "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -16458,17 +24701,30 @@
     "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -16477,16 +24733,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
-      "user",
       "action",
-      "operation_type",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16494,16 +24764,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "_document_id",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16511,16 +24795,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user_id",
       "@timestamp",
-      "user",
+      "_document_id",
       "action",
-      "request_access_security_header"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16528,62 +24826,97 @@
     "description": "A new user account was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "email",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "created_at",
       "_document_id",
-      "user_agent",
-      "actor",
-      "actor_id",
       "action",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "user.create_integration_secret",
-    "description": "A user secret for Codespaces was created.",
-    "docs_reference_links": "N/A",
-    "fields": [
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
-      "visibility",
-      "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "email",
       "operation_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
-    "action": "user.creation_rate_limit_exceeded",
-    "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
+    "action": "user.create_integration_secret",
+    "description": "A user secret for Codespaces was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "oauth_application_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "key",
+      "visibility",
+      "integration",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "user.creation_rate_limit_exceeded",
+    "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -16591,18 +24924,30 @@
     "description": "A user account was destroyed by an asynchronous job.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16611,19 +24956,30 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "oauth_application_id",
+      "_document_id",
       "action",
-      "user",
-      "created_at",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16631,18 +24987,30 @@
     "description": "A user deleted his or her account, triggering user.async_delete.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
-      "created_at",
-      "user_agent",
       "user_id",
-      "operation_type",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16650,18 +25018,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "user_agent",
       "user_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16669,18 +25049,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "_document_id",
-      "@timestamp",
-      "user",
-      "actor_id",
-      "action",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -16689,17 +25081,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "request_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16707,17 +25111,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16725,17 +25142,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16743,17 +25173,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16761,21 +25204,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16783,21 +25236,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -16806,17 +25269,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16824,17 +25300,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16842,17 +25331,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16860,18 +25362,30 @@
     "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "org_id",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16879,16 +25393,29 @@
     "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ]
   },
@@ -16897,17 +25424,31 @@
     "description": "A user requested a password reset.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
     "fields": [
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "email",
-      "created_at",
-      "user_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
   },
@@ -16916,17 +25457,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "created_at",
-      "user_agent",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "request_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16934,18 +25488,30 @@
     "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -16954,19 +25520,31 @@
     "description": "A user signed in.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "actor_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "_document_id",
-      "request_id",
       "created_at",
-      "actor",
-      "passkey_nickname",
-      "request_access_security_header"
+      "passkey_nickname"
     ]
   },
   {
@@ -16974,18 +25552,30 @@
     "description": "A user signed out.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -16993,19 +25583,30 @@
     "description": "A comment made by a user was minimized.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
-      "actor_id",
       "@timestamp",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "user",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17013,18 +25614,30 @@
     "description": "A user signed in from a new device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17032,14 +25645,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17047,21 +25676,31 @@
     "description": "An ordinary user account was promoted to a site administrator.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
+      "user_id",
       "user_agent",
+      "created_at",
       "oauth_application_id",
-      "request_id",
-      "operation_type",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17069,16 +25708,29 @@
     "description": "A user's account was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user",
-      "action",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "operation_type"
     ]
   },
@@ -17087,20 +25739,31 @@
     "description": "An email address was removed from a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "actor_id",
       "created_at",
-      "email",
-      "token_scopes",
-      "programmatic_access_type"
+      "email"
     ]
   },
   {
@@ -17108,20 +25771,32 @@
     "description": "A user secret for Codespaces was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "key",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17129,17 +25804,30 @@
     "description": "A user account was no longer flagged as a large scale contributor.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -17147,20 +25835,31 @@
     "description": "A username was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "request_id",
-      "actor_id",
-      "old_login",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_login",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17168,17 +25867,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "user_agent",
-      "request_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -17187,18 +25898,30 @@
     "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "action",
       "created_at",
-      "actor",
-      "operation_type",
-      "actor_id",
-      "user_id",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam"
   },
@@ -17207,18 +25930,30 @@
     "description": "A user reset their account password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17226,16 +25961,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -17246,16 +25994,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -17264,18 +26024,30 @@
     "description": "A user signed in from an unrecognized device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor",
-      "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -17283,18 +26055,30 @@
     "description": "A user signed in from an unrecognized device and location.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "created_at",
-      "_document_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17302,18 +26086,30 @@
     "description": "A user signed in from an unrecognized location.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "action",
-      "operation_type",
-      "user_agent",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
       "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17321,46 +26117,67 @@
     "description": "Triggered when you clear the status on your profile.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "message",
-      "user",
-      "actor_id",
       "created_at",
+      "limited_availability",
+      "emoji",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "user_status.update",
+    "description": "Triggered when you set or change the status on your profile.",
+    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "limited_availability",
-      "action",
-      "emoji",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "user_status.update",
-    "description": "Triggered when you set or change the status on your profile.",
-    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
-    "fields": [
       "limited_availability",
-      "user",
-      "action",
-      "actor_id",
       "message",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
-      "user_agent",
       "emoji",
-      "org",
-      "actor",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
   },
@@ -17369,21 +26186,31 @@
     "description": "A user account was suspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "user_agent",
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "token_scopes",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17391,18 +26218,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
-      "actor_id",
       "@timestamp",
-      "operation_type",
       "_document_id",
-      "user_agent",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17410,18 +26249,30 @@
     "description": "A 2FA challenge issued for a user account failed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "actor_id",
-      "actor",
-      "user_id",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17431,16 +26282,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
       "user_agent",
-      "request_id",
-      "action",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17448,18 +26311,30 @@
     "description": "A user used their 2FA recovery codes.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17467,18 +26342,30 @@
     "description": "A user downloaded 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17486,17 +26373,30 @@
     "description": "A user printed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17504,18 +26404,30 @@
     "description": "A user viewed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_agent",
-      "actor",
-      "user_id",
-      "action",
-      "created_at",
-      "user",
-      "operation_type",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "request_access_security_header"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17523,17 +26435,30 @@
     "description": "A user was prompted for a two-factor authentication code.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
     "fields": [
-      "user",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "actor"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
   },
@@ -17542,19 +26467,31 @@
     "description": "A user was unblocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "user_agent",
-      "user_id",
-      "user",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -17563,15 +26500,28 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user_agent",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "request_id",
-      "actor",
-      "action",
       "created_at"
     ]
   },
@@ -17580,21 +26530,31 @@
     "description": "A user account was unsuspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "user_agent",
       "actor",
-      "oauth_application_id",
-      "operation_type",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "user_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17602,21 +26562,33 @@
     "description": "A user secret for Codespaces was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17624,18 +26596,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17643,16 +26627,30 @@
     "description": "A Dependabot rule was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17662,16 +26660,30 @@
     "description": "A Dependabot rule was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17681,18 +26693,31 @@
     "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17702,21 +26727,33 @@
     "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17724,21 +26761,32 @@
     "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -17746,21 +26794,32 @@
     "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -17768,16 +26827,30 @@
     "description": "A Dependabot rule's conditions, actions, or metadata changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17787,27 +26860,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -17816,23 +26895,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17840,10 +26929,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17854,20 +26961,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -17876,23 +26972,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17902,10 +27006,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17917,19 +27039,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -17940,10 +27052,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17952,21 +27082,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -17976,23 +27095,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -18001,22 +27132,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -18024,21 +27166,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -18046,25 +27199,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -18072,23 +27233,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -18102,24 +27276,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -18128,10 +27311,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -18141,21 +27342,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -18165,25 +27356,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.18/organization.json b/src/audit-logs/data/ghes-3.18/organization.json
index 3de92e4d061c..3d8cd114ddae 100644
--- a/src/audit-logs/data/ghes-3.18/organization.json
+++ b/src/audit-logs/data/ghes-3.18/organization.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,29 +67,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -72,21 +103,32 @@
     "description": "Credit was accepted for a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Editing a repository security advisory"
   },
@@ -95,21 +137,32 @@
     "description": "Someone was added to the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -117,21 +170,32 @@
     "description": "Credit was declined for a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -140,21 +204,32 @@
     "description": "Someone was removed from the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -163,18 +238,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -182,17 +269,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -203,39 +301,62 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
+  },
   {
     "action": "billing.change_billing_type",
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -244,19 +365,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -265,18 +398,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -284,18 +430,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -303,20 +461,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -325,20 +494,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -349,17 +529,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -367,15 +559,31 @@
     "description": "Existing code scanning alerts appeared in a branch.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -385,15 +593,31 @@
     "description": "Code scanning alerts were fixed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -403,15 +627,31 @@
     "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_numbers",
-      "commit_oid",
-      "ref",
-      "request_id",
-      "org_id",
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
-      "business"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_numbers",
+      "commit_oid",
+      "ref"
     ],
     "docs_reference_titles": "About code scanning"
   },
@@ -420,15 +660,29 @@
     "description": "Code scanning alerts were manually dismissed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers",
       "dismissal_approver_id"
     ],
@@ -439,19 +693,31 @@
     "description": "Dismissal of code scanning alerts was approved.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -462,19 +728,31 @@
     "description": "Dismissal of code scanning alerts was denied.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -485,19 +763,31 @@
     "description": "Dismissal of code scanning alerts was requested.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -508,13 +798,31 @@
     "description": "Code scanning alerts were seen for the first time.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -524,15 +832,31 @@
     "description": "Code scanning alerts that were previously fixed reappeared.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -542,15 +866,29 @@
     "description": "Code scanning alerts that were previously dismissed were reopened.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -560,14 +898,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -577,28 +930,34 @@
     "description": "An attempt to create a codespace from a prebuild was made.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "owner",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "user_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
       "created_at",
       "operation_type",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -606,17 +965,30 @@
     "description": "Enterprise setting for Codespaces ownership was updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enablement",
       "organization_names",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -627,25 +999,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -656,22 +1037,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -683,22 +1075,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -707,15 +1110,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -726,15 +1144,28 @@
     "description": "Policies were applied to codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -744,20 +1175,30 @@
     "description": "Policies were removed from codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -765,19 +1206,30 @@
     "description": "Policies were updated for codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -785,17 +1237,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -805,27 +1270,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -833,19 +1307,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -853,18 +1340,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -873,20 +1372,30 @@
     "description": "A commit comment was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "created_at",
-      "@timestamp",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "programmatic_access_type"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -894,21 +1403,30 @@
     "description": "A commit comment was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_id",
-      "action",
-      "@timestamp",
-      "repo",
       "org_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -916,21 +1434,33 @@
     "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "reason",
       "plan",
-      "org_id",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -938,13 +1468,28 @@
     "description": "Copilot feature settings were changed at the organization level.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -954,23 +1499,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -978,16 +1530,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -996,40 +1562,59 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "copilot.cfb_seat_assignment_reused",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "copilot.cfb_seat_assignment_reused",
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1039,20 +1624,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1060,19 +1655,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -1080,21 +1687,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1102,21 +1718,33 @@
     "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_value",
       "new_value",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1124,21 +1752,32 @@
     "description": "The excluded paths for GitHub Copilot were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "excluded_paths",
       "owner_type",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1146,14 +1785,28 @@
     "description": "Copilot custom instructions were created for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "custom_instructions"
@@ -1164,14 +1817,28 @@
     "description": "Copilot custom instructions were updated for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "custom_instructions"
@@ -1182,21 +1849,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1204,21 +1881,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1226,21 +1913,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1248,17 +1945,30 @@
     "description": "The plan for GitHub Copilot was updated.",
     "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_plan",
       "plan",
-      "business_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1270,20 +1980,31 @@
     "description": "The plan for GitHub Copilot was scheduled to be downgraded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "current_plan",
       "scheduled_plan"
@@ -1294,22 +2015,33 @@
     "description": "Specific repositories were disabled from using Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "owner_type",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1317,21 +2049,31 @@
     "description": "Specific repositories were enabled to use Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "owner_type",
-      "owner",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1341,20 +2083,32 @@
     "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_access",
       "old_access",
-      "org_id",
       "owner_type",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1364,21 +2118,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1388,19 +2151,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1410,21 +2182,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1434,18 +2215,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1458,18 +2252,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1483,14 +2290,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -1503,8 +2325,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1513,27 +2334,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1542,19 +2371,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1563,16 +2404,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "definition_id"
@@ -1584,19 +2438,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1605,19 +2470,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1626,40 +2502,62 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
-  },
-  {
-    "action": "dependabot_alerts_new_repos.enable",
-    "description": "Dependabot alerts were enabled for all new repositories.",
-    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "user",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
+  },
+  {
+    "action": "dependabot_alerts_new_repos.enable",
+    "description": "Dependabot alerts were enabled for all new repositories.",
+    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1668,21 +2566,31 @@
     "description": "The default repository access for Dependabot was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "access_level",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -1691,17 +2599,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1709,19 +2630,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1730,19 +2662,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1750,19 +2693,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1771,19 +2725,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1791,19 +2756,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1812,39 +2788,61 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
-    ]
-  },
-  {
-    "action": "dependency_graph_new_repos.disable",
-    "description": "The dependency graph was disabled for all new repositories.",
-    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "dependency_graph_new_repos.disable",
+    "description": "The dependency graph was disabled for all new repositories.",
+    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1853,20 +2851,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1874,21 +2882,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "repo_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "org_id",
-      "_document_id",
       "actor_id",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1896,20 +2913,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "request_id",
-      "org",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1917,22 +2944,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "actor_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "title",
-      "_document_id",
-      "created_at",
-      "repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -1940,21 +2976,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "team",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "number",
-      "org",
-      "title",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id"
+      "team",
+      "created_at",
+      "number",
+      "title",
+      "operation_type"
     ]
   },
   {
@@ -1962,18 +3010,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user_id",
-      "actor",
       "number",
-      "user",
-      "created_at",
-      "request_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1981,18 +3042,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "_document_id",
-      "request_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "number",
       "team",
       "created_at"
@@ -2003,21 +3075,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "title",
-      "user",
-      "user_agent",
-      "org",
-      "operation_type",
-      "actor_id",
-      "@timestamp",
-      "actor",
-      "team",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type",
+      "team",
       "number"
     ]
   },
@@ -2026,17 +3109,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2047,16 +3144,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2067,18 +3178,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
       "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2089,17 +3214,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was created.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "org_id",
       "action",
-      "request_id",
-      "org",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -2108,17 +3246,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "actor_id",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -2127,22 +3278,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2151,22 +3311,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2174,28 +3344,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2204,27 +3380,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
-      "visibility",
-      "environment_name",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "visibility",
+      "environment_name",
+      "public_repo",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2233,25 +3417,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2260,26 +3452,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2288,21 +3487,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2311,22 +3522,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2335,25 +3556,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2362,22 +3592,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2386,21 +3628,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -2411,19 +3663,30 @@
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2432,20 +3695,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2454,19 +3727,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2475,23 +3759,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2499,18 +3792,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2521,20 +3824,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2544,25 +3857,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -2570,25 +3893,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -2596,26 +3928,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -2624,25 +3965,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -2650,26 +4000,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -2677,21 +4036,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -2700,19 +4070,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -2720,21 +4103,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -2743,19 +4137,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -2766,20 +4174,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2789,24 +4209,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2817,23 +4248,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2844,21 +4287,33 @@
     "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
       "operation_type",
-      "@timestamp",
       "integration",
-      "action",
-      "user_agent",
       "reason",
-      "_document_id",
-      "org",
-      "org_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -2869,20 +4324,32 @@
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
       "@timestamp",
-      "actor_id",
-      "org",
       "_document_id",
-      "requester",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "requester",
       "created_at",
       "url",
-      "org_id",
-      "request_id",
       "operation_type",
-      "actor",
       "integration",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -2892,20 +4359,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2915,19 +4395,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -2936,20 +4430,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -2959,20 +4466,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -2981,20 +4501,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -3003,20 +4536,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -3024,19 +4569,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -3045,19 +4603,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -3066,17 +4637,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -3089,21 +4673,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -3117,17 +4714,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -3139,19 +4749,30 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "user"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3159,19 +4780,30 @@
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3179,20 +4811,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "user_id",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
-      "_document_id",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "actor_id",
       "operation_type",
-      "org",
       "created_at"
     ]
   },
@@ -3201,19 +4842,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3221,24 +4873,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3246,24 +4906,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "ip_allow_list_entry",
-      "org",
-      "operation_type",
-      "created_at",
-      "active",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at",
+      "active"
     ]
   },
   {
@@ -3271,19 +4939,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "org",
       "action",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "actor",
       "actor_id",
-      "ip_allow_list_entry",
-      "active",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "ip_allow_list_entry",
+      "active"
     ]
   },
   {
@@ -3291,22 +4972,31 @@
     "description": "A comment on an issue was deleted from the repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "org",
-      "repo",
-      "actor_id",
       "@timestamp",
-      "created_at",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "oauth_application_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -3314,24 +5004,30 @@
     "description": "A comment on an issue was pinned to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3342,19 +5038,29 @@
     "description": "A comment on an issue was unpinned from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3365,22 +5071,31 @@
     "description": "A comment on an issue (other than the initial one) changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "action",
-      "repo_id",
-      "org_id",
-      "created_at",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "request_id",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
-      "oauth_application_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -3388,21 +5103,31 @@
     "description": "An issue was deleted from the repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue",
     "fields": [
-      "user",
-      "actor_id",
-      "created_at",
-      "title",
       "@timestamp",
       "_document_id",
-      "request_id",
-      "actor",
-      "user_id",
       "action",
-      "operation_type",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type"
     ],
     "docs_reference_titles": "Deleting an issue"
   },
@@ -3411,23 +5136,33 @@
     "description": "An issue was pinned to a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
       "action",
       "actor",
-      "operation_type",
-      "owner_type",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "number",
-      "repo",
-      "event",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "owner_type",
+      "number",
+      "event"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3436,22 +5171,32 @@
     "description": "An issue was transferred to another repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "owner_type",
-      "actor_id",
       "number",
-      "repo",
       "operation_type",
-      "_document_id",
-      "repo_id",
-      "action",
-      "request_id",
-      "created_at",
-      "actor",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Transferring an issue to another repository"
   },
@@ -3460,20 +5205,32 @@
     "description": "An issue type was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issue_type_name",
       "description",
       "color",
       "enabled",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3484,20 +5241,32 @@
     "description": "An issue type was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issue_type_name",
       "description",
       "color",
       "enabled",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3508,11 +5277,28 @@
     "description": "An issue type was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issue_type_name",
       "description",
       "color",
@@ -3521,11 +5307,6 @@
       "old_description",
       "old_color",
       "old_enabled",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3536,24 +5317,33 @@
     "description": "An issue was unpinned from a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
-      "event",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
-      "action",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "operation_type",
-      "_document_id",
-      "number",
-      "owner_type",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "token_scopes",
-      "request_access_security_header"
+      "user_agent",
+      "event",
+      "created_at",
+      "operation_type",
+      "number",
+      "owner_type"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3562,19 +5352,30 @@
     "description": "The ability for enterprise members to delete issues was disabled  Members cannot delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
-      "operation_type",
-      "request_id",
-      "actor_id",
-      "user_id",
-      "created_at",
       "_document_id",
+      "action",
       "actor",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "org_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3583,18 +5384,29 @@
     "description": "The ability for enterprise members to delete issues was enabled  Members can delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -3604,19 +5416,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user",
-      "request_id",
-      "actor",
-      "business_id",
-      "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3625,18 +5448,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3644,21 +5479,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -3666,21 +5514,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3688,22 +5549,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
-      "user",
-      "created_at",
-      "user_agent",
-      "oauth_application",
       "action",
-      "request_id",
-      "marketplace_listing",
-      "user_id",
-      "secondary_category",
-      "oauth_application_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "created_at",
+      "oauth_application",
+      "marketplace_listing",
+      "secondary_category",
+      "oauth_application_id",
+      "operation_type"
     ]
   },
   {
@@ -3711,19 +5585,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -3733,22 +5620,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -3756,22 +5656,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3779,20 +5692,30 @@
     "description": "The ability for members to publish GitHub Pages sites was disabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3801,20 +5724,30 @@
     "description": "The ability for members to publish GitHub Pages sites was enabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3823,21 +5756,30 @@
     "description": "The ability for members to publish private GitHub Pages was disabled  Members cannot publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3846,22 +5788,30 @@
     "description": "The ability for members to publish private GitHub Pages was enabled  Members can publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3870,21 +5820,30 @@
     "description": "The ability for members to publish public GitHub Pages was disabled  Members cannot publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3893,22 +5852,30 @@
     "description": "The ability for members to publish public GitHub Pages was enabled  Members can publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3917,19 +5884,30 @@
     "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "operation_type",
       "user_agent",
-      "actor",
-      "actor_id",
-      "business_id",
-      "@timestamp",
-      "created_at",
-      "action"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3938,18 +5916,29 @@
     "description": "The ability for enterprise members to delete repositories was disabled  Members cannot delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "request_id",
-      "org",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "actor",
       "operation_type",
-      "org_id",
-      "action",
-      "@timestamp",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -3959,21 +5948,30 @@
     "description": "The ability for enterprise members to delete repositories was enabled  Members can delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "action",
-      "org_id",
-      "user_id",
-      "business",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
-      "org",
-      "operation_type",
-      "user_agent"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3984,16 +5982,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -4002,21 +6011,30 @@
     "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "created_at",
-      "user_id",
       "business_id",
-      "user",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "org_id",
-      "@timestamp"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4025,19 +6043,30 @@
     "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "user_id",
-      "business",
-      "business_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "actor_id"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4046,19 +6075,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4066,21 +6107,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4090,16 +6140,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4109,18 +6172,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4130,14 +6206,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -4145,19 +6237,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -4165,18 +6268,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4184,23 +6299,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -4208,16 +6331,30 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "org_id",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4225,24 +6362,32 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
-      "repo_id",
       "operation_type",
-      "@timestamp",
-      "user_agent",
       "created_at",
-      "org",
-      "action",
-      "_document_id",
-      "repo",
-      "actor",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4250,15 +6395,28 @@
     "description": "A network configuration for a hosted compute service was created.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4276,15 +6434,28 @@
     "description": "A network configuration for a hosted compute service was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4297,45 +6468,70 @@
     "description": "A network configuration for a hosted compute service was updated.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "actor_is_bot",
-      "selected_service",
-      "network_settings_ids",
-      "previous_settings_ids",
-      "failover_network_settings_ids",
-      "failover_network_enabled"
-    ],
-    "docs_reference_titles": "About networking for hosted compute products in your enterprise"
-  },
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot",
+      "selected_service",
+      "network_settings_ids",
+      "previous_settings_ids",
+      "failover_network_settings_ids",
+      "failover_network_enabled"
+    ],
+    "docs_reference_titles": "About networking for hosted compute products in your enterprise"
+  },
   {
     "action": "oauth_application.create",
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4344,20 +6540,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4366,20 +6574,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4388,20 +6608,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4410,19 +6642,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4431,20 +6676,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4453,20 +6710,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4475,19 +6744,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4496,17 +6778,28 @@
     "description": "An invitation sent to an organization to join an enterprise was accepted.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4517,20 +6810,30 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
   },
@@ -4539,19 +6842,29 @@
     "description": "An organization prevented access to resources by users with the given two-factor method.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "two_factor_method",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "two_factor_method",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4562,21 +6875,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -4585,24 +6908,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4610,21 +6943,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -4632,20 +6975,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4653,22 +7006,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4676,20 +7037,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4697,44 +7068,62 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
-    ]
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "org.advanced_security_entity_policy_update",
     "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "new_policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -4744,19 +7133,30 @@
     "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4765,19 +7165,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -4787,15 +7198,28 @@
     "description": "Third-party application access for outside collaborators was disabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4806,15 +7230,28 @@
     "description": "Third-party application access for outside collaborators was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4825,15 +7262,28 @@
     "description": "The organization was archived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4843,17 +7293,30 @@
     "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
   },
@@ -4862,21 +7325,32 @@
     "description": "An export of the organization's Git events was created.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "start",
       "end",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization"
   },
@@ -4885,16 +7359,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -4903,18 +7390,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
-      "actor",
-      "user_agent",
-      "org_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "blocked_user",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -4923,19 +7423,30 @@
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -4945,22 +7456,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "email",
-      "@timestamp",
-      "actor",
-      "action",
       "operation_type",
-      "user_agent",
-      "org",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -4968,19 +7490,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -4988,16 +7521,28 @@
     "description": "Cleared two-factor authentication restrictions for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5008,23 +7553,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5032,21 +7585,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5054,23 +7617,31 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5078,23 +7649,31 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5102,21 +7681,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -5125,21 +7713,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -5148,20 +7745,31 @@
     "description": "Access to use Codespaces on internal and private repositories was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "enablement",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "enablement",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization"
   },
@@ -5170,21 +7778,31 @@
     "description": "Ownership and payment for codespaces was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "owner_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
   },
@@ -5193,16 +7811,29 @@
     "description": "A team has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5212,16 +7843,29 @@
     "description": "A team has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5231,19 +7875,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -5252,17 +7907,30 @@
     "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -5271,21 +7939,30 @@
     "description": "A user has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5293,21 +7970,30 @@
     "description": "A user has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5315,16 +8001,29 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
@@ -5334,17 +8033,30 @@
     "description": "The interaction limit for prior contributors only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5353,17 +8065,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5373,16 +8098,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5391,17 +8129,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5410,17 +8161,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5429,22 +8193,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -5453,17 +8225,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5474,15 +8257,28 @@
     "description": "Server statistics were exported for the organization.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5493,18 +8289,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
-      "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -5513,20 +8321,31 @@
     "description": "A GitHub Actions secret was created for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5535,20 +8354,32 @@
     "description": "A GitHub Actions variable was created for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
-      "visibility",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "visibility",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5557,21 +8388,33 @@
     "description": "A Codespaces or Dependabot secret was created for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5579,21 +8422,30 @@
     "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "org_id",
-      "business",
-      "action",
       "@timestamp",
-      "org",
       "_document_id",
-      "business_id",
+      "action",
       "actor",
-      "token_scopes",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "actor_is_bot",
       "oauth_credential_type",
       "managed_oauth_access_id",
@@ -5609,24 +8461,32 @@
     "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
-      "created_at",
-      "org_id",
-      "business_id",
-      "operation_type",
-      "request_id",
       "_document_id",
       "action",
+      "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "token_scopes",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot",
       "oauth_credential_type",
-      "request_access_security_header",
       "managed_oauth_access_id",
       "managed_token_id",
       "managed_oauth_scopes",
@@ -5640,21 +8500,32 @@
     "description": "An owner revoked authorized credentials.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "oauth_application_id",
-      "org_id",
       "operation_type",
-      "action",
-      "business",
-      "request_id",
       "created_at",
-      "business_id",
-      "actor_id",
-      "_document_id",
-      "user_agent",
       "oauth_credential_type",
       "managed_oauth_access_id",
       "managed_token_id",
@@ -5669,18 +8540,30 @@
     "description": "An organization was deleted by a user or staff.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "org_id",
-      "org",
       "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5688,20 +8571,30 @@
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -5710,16 +8603,29 @@
     "description": "Third-party application access restrictions for an organization were disabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization"
@@ -5729,19 +8635,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -5750,37 +8667,63 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "sso_url",
-      "issuer",
-      "action",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "org",
-      "operation_type"
-    ]
-  },
-  {
-    "action": "org.disable_source_ip_disclosure",
-    "description": "Display of IP addresses within audit log events for the organization was disabled.",
-    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
-    "fields": [
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "issuer",
       "created_at",
-      "operation_type",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "org.disable_source_ip_disclosure",
+    "description": "Display of IP addresses within audit log events for the organization was disabled.",
+    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "business_id"
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -5789,17 +8732,30 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5807,19 +8763,30 @@
     "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5827,19 +8794,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
-      "action",
-      "actor_id",
-      "org_id"
+      "created_at"
     ]
   },
   {
@@ -5847,19 +8825,30 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -5868,17 +8857,30 @@
     "description": "Third-party application access restrictions for an organization were enabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "operation_type",
-      "org",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization"
   },
@@ -5887,19 +8889,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -5908,19 +8921,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "sso_url",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "issuer",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "sso_url",
+      "created_at",
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -5929,21 +8955,30 @@
     "description": "Display of IP addresses within audit log events for the organization was enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -5952,17 +8987,30 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
   },
@@ -5971,17 +9019,30 @@
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -5990,18 +9051,31 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
-      "org",
-      "user_agent",
-      "request_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "manager",
       "operation_type",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6009,23 +9083,32 @@
     "description": "A new user was invited to join an organization.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
     "fields": [
-      "org",
-      "user_id",
-      "invitation_id",
-      "org_id",
-      "user",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -6034,17 +9117,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6054,19 +9148,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6074,19 +9179,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6094,19 +9210,31 @@
     "description": "Access to an organization was granted for an OAuth App.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "operation_type",
-      "org_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization"
@@ -6116,20 +9244,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -6138,40 +9277,65 @@
     "description": "Access was disabled for an OAuth App that was previously approved.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization",
     "fields": [
-      "request_id",
-      "url",
-      "created_at",
-      "org_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_name"
-    ],
-    "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
+      "operation_type",
+      "oauth_application_name"
+    ],
+    "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
   },
   {
     "action": "org.oauth_app_access_requested",
     "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "url",
-      "org_id",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "url",
       "oauth_application_name"
     ]
   },
@@ -6180,20 +9344,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -6203,16 +9378,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6220,20 +9408,31 @@
     "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "reason",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "reason",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -6242,20 +9441,30 @@
     "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -6264,19 +9473,30 @@
     "description": "An organization owner downloaded the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6285,19 +9505,30 @@
     "description": "An organization owner generated the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6306,19 +9537,30 @@
     "description": "An organization owner printed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6327,40 +9569,63 @@
     "description": "An organization owner viewed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id"
-    ],
-    "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
-  },
-  {
-    "action": "org.register_self_hosted_runner",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
+  },
+  {
+    "action": "org.register_self_hosted_runner",
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -6369,20 +9634,31 @@
     "description": "A GitHub Actions secret was removed from an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -6391,21 +9667,31 @@
     "description": "A GitHub Actions variable was removed from an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -6414,18 +9700,29 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
@@ -6435,19 +9732,29 @@
     "description": "Removed a two-factor authentication method restriction for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "two_factor_method",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "two_factor_method",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -6458,22 +9765,32 @@
     "description": "A Codespaces or Dependabot secret was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6481,21 +9798,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6503,21 +9829,30 @@
     "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user",
-      "org_id",
-      "created_at",
-      "request_id",
       "@timestamp",
-      "action",
-      "operation_type",
-      "user_agent",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6525,21 +9860,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
-      "org",
-      "team",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "programmatic_access_type"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6547,18 +9892,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -6567,19 +9924,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
-      "old_login",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_login",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6587,14 +9956,28 @@
     "description": "Triggered when a required workflow is created.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6605,14 +9988,28 @@
     "description": "Triggered when a required workflow is deleted.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6623,14 +10020,28 @@
     "description": "Triggered when a required workflow is updated.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6641,20 +10052,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -6663,18 +10084,29 @@
     "description": "A member's linked identity was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
       "user_id",
-      "@timestamp",
-      "action",
-      "actor_id",
       "user_agent",
-      "_document_id",
-      "request_id",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
@@ -6684,19 +10116,30 @@
     "description": "A member's SAML session was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
-      "actor_id",
-      "created_at",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
   },
@@ -6705,21 +10148,33 @@
     "description": "A self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -6729,21 +10184,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6752,20 +10217,31 @@
     "description": "A self-hosted runner group was renamed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6774,23 +10250,33 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -6799,23 +10285,31 @@
     "description": "A self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6824,19 +10318,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -6845,25 +10352,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6872,21 +10390,32 @@
     "description": "The visibility of a self-hosted runner group was updated via the REST API.",
     "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
   },
@@ -6895,21 +10424,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -6919,21 +10457,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -6943,20 +10490,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6965,22 +10522,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -6989,21 +10554,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7012,21 +10586,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7035,22 +10618,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7059,21 +10650,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7082,22 +10682,30 @@
     "description": "Generic secrets have been disabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7105,22 +10713,30 @@
     "description": "Generic secrets have been enabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7128,21 +10744,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7152,21 +10777,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7176,19 +10810,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7198,21 +10843,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7222,21 +10876,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7246,19 +10909,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7268,22 +10942,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7292,22 +10974,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7316,22 +11006,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7340,21 +11038,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7363,21 +11070,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7386,22 +11102,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7410,22 +11134,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7434,26 +11166,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -7462,26 +11203,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7489,28 +11238,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7518,26 +11275,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7545,15 +11310,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7562,15 +11344,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7579,7 +11378,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -7594,20 +11414,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -7616,16 +11447,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -7636,18 +11480,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -7656,17 +11513,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7674,18 +11544,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -7694,18 +11576,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -7714,18 +11609,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -7734,22 +11641,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issuer",
-      "business",
       "operation_type",
       "created_at",
-      "request_id",
-      "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7757,21 +11674,32 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
   },
@@ -7780,19 +11708,30 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -7803,15 +11742,28 @@
     "description": "The organization was unarchived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7821,19 +11773,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
-      "oauth_application_id",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "blocked_user",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -7842,20 +11807,32 @@
     "description": "A GitHub Actions secret was updated for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "created_at",
       "key",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -7864,23 +11841,34 @@
     "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -7889,20 +11877,32 @@
     "description": "A GitHub Actions variable was updated for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -7911,20 +11911,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -7932,22 +11944,33 @@
     "description": "A Codespaces or Dependabot secret was updated for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7956,20 +11979,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -7977,17 +12011,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -7997,20 +12044,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -8019,36 +12077,62 @@
     "description": "The name of the default branch was changed for new repositories in the organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
-  },
-  {
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
+  },
+  {
     "action": "org.update_repo_self_hosted_runners_policy",
     "description": "The repository self-hosted runners policy was updated",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_repo_runners_policy",
       "new_repo_runners_policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8059,19 +12143,32 @@
     "description": "An organization's SAML provider settings were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "issuer",
-      "org",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -8079,18 +12176,30 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "org",
-      "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
@@ -8099,18 +12208,30 @@
     "description": "A default label was created for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
-      "_document_id",
-      "action",
-      "created_at",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label"
   },
@@ -8119,17 +12240,30 @@
     "description": "A default label was deleted for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label"
   },
@@ -8138,17 +12272,30 @@
     "description": "A default label was edited for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label",
     "fields": [
-      "org",
-      "created_at",
       "@timestamp",
-      "actor",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label"
   },
@@ -8157,20 +12304,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "org_id",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -8179,16 +12339,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8197,14 +12372,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -8215,16 +12405,31 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "operation_type",
-      "domain_name",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
       "_document_id",
-      "actor_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "domain_name",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8233,16 +12438,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -8252,17 +12470,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8272,16 +12501,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -8291,20 +12533,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -8312,19 +12564,30 @@
     "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor",
-      "business_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
       "user_agent",
-      "_document_id",
       "created_at",
-      "operation_type",
-      "request_id",
-      "business"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -8333,19 +12596,30 @@
     "description": "Organization projects were disabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -8354,18 +12628,29 @@
     "description": "Organization projects were enabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor_id",
-      "org_id",
-      "created_at",
-      "user_id",
-      "org",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
@@ -8375,23 +12660,33 @@
     "description": "An organization role was assigned to a user or team.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About custom organization roles"
   },
@@ -8400,25 +12695,32 @@
     "description": "A custom organization role was created in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8430,25 +12732,32 @@
     "description": "A custom organization role was deleted in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8459,19 +12768,30 @@
     "description": "A user or team was unassigned an organization role.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type"
     ],
@@ -8482,26 +12802,33 @@
     "description": "A custom organization role was edited in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
       "old_role_permissions",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -8514,22 +12841,33 @@
     "description": "An organization's default project base role was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_project_base_role",
-      "new_project_base_role",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_project_base_role",
+      "new_project_base_role",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8537,20 +12875,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -8560,23 +12909,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8585,21 +12945,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -8610,21 +12981,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8633,20 +13017,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8655,20 +13053,35 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
-      "owner_type",
-      "domain",
-      "state",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type"
-    ],
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
+      "owner_type",
+      "domain",
+      "state",
+      "created_at",
+      "operation_type"
+    ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
   {
@@ -8676,20 +13089,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -8698,18 +13125,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8717,16 +13156,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8734,18 +13187,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8753,18 +13218,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8775,22 +13253,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8798,22 +13285,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8821,18 +13317,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8843,18 +13352,28 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8865,18 +13384,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8887,23 +13416,34 @@
     "description": "A personal access token expiration limit was set.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "token_expiration",
       "old_token_expiration",
       "exempt_administrators",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8911,21 +13451,32 @@
     "description": "A personal access token expiration limit was unset.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "programmatic_access_type",
-      "old_token_expiration",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_token_expiration",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8933,17 +13484,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8954,18 +13518,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8977,17 +13554,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -8999,20 +13589,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9024,20 +13623,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9049,20 +13657,29 @@
     "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9074,20 +13691,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9099,15 +13725,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9117,17 +13758,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9137,15 +13789,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9155,19 +13822,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "business_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9175,23 +13853,30 @@
     "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "created_at",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
-      "repo",
       "action",
-      "user_agent",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "request_id",
-      "user_id",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9199,23 +13884,30 @@
     "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "repo",
-      "org",
-      "business",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org_id",
-      "created_at",
-      "business_id"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9223,17 +13915,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9243,17 +13946,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9263,17 +13977,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9283,17 +14008,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9303,17 +14039,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -9323,17 +14072,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9341,25 +14103,36 @@
     "description": "A project's base role was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_project_base_role",
       "new_project_base_role",
       "project_number",
       "public_project",
-      "business",
       "project_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9367,20 +14140,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -9390,25 +14174,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -9416,20 +14212,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9437,25 +14245,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9463,17 +14283,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9481,17 +14314,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9499,18 +14345,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -9519,18 +14377,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -9539,19 +14409,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -9559,17 +14440,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -9581,22 +14475,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -9604,19 +14507,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9624,17 +14538,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9642,18 +14569,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -9661,20 +14601,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9682,38 +14632,62 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
-  },
-  {
-    "action": "project_view.delete",
-    "description": "A view was deleted in a project board.",
-    "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
-    "fields": [
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
+  },
+  {
+    "action": "project_view.delete",
+    "description": "A view was deleted in a project board.",
+    "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -9722,16 +14696,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -9743,21 +14730,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -9765,22 +14764,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -9789,29 +14798,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9819,24 +14833,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "repo_id",
-      "user_id",
       "@timestamp",
-      "user_agent",
-      "repo",
-      "name",
-      "org_id",
-      "user",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -9847,21 +14869,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -9872,22 +14904,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -9895,24 +14937,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "authorized_actors_only",
       "authorized_actors",
       "created_at",
-      "user_agent",
       "name",
-      "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
-      "actor_id",
-      "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -9920,30 +14972,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -9953,28 +15012,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -9985,23 +15052,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -10009,22 +15085,32 @@
     "description": "Branch deletion was enabled or disabled for a protected branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "operation_type",
-      "request_id",
-      "repo",
       "@timestamp",
-      "org_id",
-      "org",
-      "action",
-      "allow_deletions_enforcement_level",
       "_document_id",
-      "created_at",
-      "actor_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_deletions_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10032,23 +15118,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "actor_id",
-      "name",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo",
-      "operation_type",
-      "request_id",
-      "allow_force_pushes_enforcement_level",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_force_pushes_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10056,24 +15151,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -10082,22 +15186,32 @@
     "description": "Required linear commit history was enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "operation_type",
       "actor",
-      "linear_history_requirement_enforcement_level",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "linear_history_requirement_enforcement_level",
       "name",
-      "org_id",
-      "repo_id",
-      "org",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -10105,24 +15219,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "lock_allows_fetch_and_merge",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "lock_allows_fetch_and_merge",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10131,27 +15254,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10160,18 +15290,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -10182,24 +15325,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -10207,25 +15359,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -10233,22 +15392,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -10256,22 +15425,33 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
   },
@@ -10280,22 +15460,32 @@
     "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "required_approving_review_count",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10303,25 +15493,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
     ]
   },
   {
@@ -10329,22 +15526,32 @@
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
       "action",
       "actor",
       "actor_id",
-      "signature_requirement_enforcement_level",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "programmatic_access_type"
+      "operation_type",
+      "name",
+      "created_at",
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -10352,22 +15559,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "created_at",
-      "repo_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "name",
-      "actor",
-      "repo",
       "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
+      "strict_required_status_checks_policy"
     ]
   },
   {
@@ -10375,23 +15592,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -10400,24 +15628,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -10426,20 +15665,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10448,21 +15701,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -10472,22 +15738,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10496,25 +15774,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10523,23 +15811,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
-      "created_at",
-      "key",
-      "fingerprint",
-      "actor_id",
       "actor",
-      "title",
-      "user_agent",
-      "user_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "read_only",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "key",
+      "fingerprint",
+      "title",
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10548,18 +15847,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -10569,21 +15882,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -10592,19 +15916,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -10615,23 +15952,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -10641,17 +15990,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -10659,19 +16022,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -10679,19 +16055,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -10701,21 +16090,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -10724,27 +16124,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
-      "pull_request_url",
-      "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
+      "pull_request_url",
+      "pull_request_title",
+      "public_repo",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -10752,23 +16159,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -10777,18 +16196,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -10796,19 +16229,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -10818,20 +16263,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
-      "repo",
-      "created_at",
-      "request_id",
-      "comment_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "comment_id",
+      "operation_type"
     ]
   },
   {
@@ -10839,18 +16295,31 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "_document_id",
-      "@timestamp",
-      "comment_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "comment_id"
     ]
   },
   {
@@ -10858,21 +16327,33 @@
     "description": "A review on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -10880,20 +16361,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -10902,19 +16396,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -10924,22 +16432,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "created_at",
-      "user_agent",
-      "actor",
+      "_document_id",
       "action",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -10948,21 +16466,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -10971,25 +16498,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -10998,23 +16532,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -11023,24 +16565,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -11049,23 +16598,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -11075,22 +16632,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -11099,19 +16665,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11120,24 +16699,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -11146,24 +16735,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11171,24 +16768,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11196,24 +16801,32 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11221,24 +16834,32 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11246,23 +16867,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11273,17 +16903,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -11293,17 +16935,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -11313,25 +16967,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11340,26 +17000,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11368,25 +17036,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "query_suite",
-      "threat_model",
-      "languages",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "query_suite",
+      "threat_model",
+      "languages",
+      "public_repo",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -11396,19 +17073,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to this repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -11417,19 +17105,30 @@
     "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11437,17 +17136,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11456,15 +17168,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -11475,16 +17200,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11494,17 +17232,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11514,19 +17265,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11535,17 +17297,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11554,26 +17329,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -11582,30 +17363,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -11615,20 +17401,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -11637,25 +17434,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -11664,23 +17469,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11688,25 +17504,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -11716,23 +17541,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -11742,23 +17576,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -11766,21 +17610,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11788,21 +17642,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
-      "action",
-      "request_id",
-      "user",
-      "repo",
-      "user_agent",
-      "_document_id",
-      "actor_id",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -11810,22 +17674,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -11833,21 +17706,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -11855,20 +17738,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11876,22 +17770,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -11899,18 +17802,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11918,22 +17835,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11941,21 +17868,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -11963,18 +17900,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -11983,22 +17932,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12007,24 +17965,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12033,23 +17999,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12057,26 +18033,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -12085,21 +18066,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -12108,25 +18098,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12134,22 +18130,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -12158,25 +18164,34 @@
     "description": "A branch was renamed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "old_branch",
-      "new_branch",
-      "default_branch",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "old_branch",
+      "new_branch",
+      "default_branch",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch"
@@ -12186,19 +18201,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12206,17 +18232,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12225,17 +18266,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12244,7 +18300,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -12259,23 +18336,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -12285,20 +18371,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -12309,21 +18406,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -12332,22 +18440,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -12356,21 +18474,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -12379,22 +18508,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -12405,16 +18544,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -12424,22 +18574,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -12448,23 +18609,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12474,19 +18645,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -12494,21 +18675,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -12517,24 +18708,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -12542,25 +18742,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12569,24 +18776,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12595,25 +18812,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12622,22 +18847,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -12646,26 +18880,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12673,31 +18915,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -12706,22 +18955,30 @@
     "description": "Someone closed a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories",
     "fields": [
-      "actor",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "created_at",
-      "repo_id",
-      "_document_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "About repository security advisories"
   },
@@ -12730,18 +18987,29 @@
     "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "_document_id",
+      "operation_type",
       "created_at"
     ]
   },
@@ -12750,17 +19018,30 @@
     "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -12769,21 +19050,30 @@
     "description": "GitHub withdrew a security advisory that was published in error.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -12791,18 +19081,30 @@
     "description": "Someone opened a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
       "repo_id",
-      "action",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12810,21 +19112,30 @@
     "description": "Someone published a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "repo_id",
       "_document_id",
-      "repo",
-      "business_id",
-      "business",
-      "request_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "org"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12832,17 +19143,30 @@
     "description": "Someone reopened as draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "repo",
-      "action",
-      "created_at",
       "@timestamp",
-      "request_id",
-      "actor_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "public_repo"
     ]
   },
@@ -12851,21 +19175,30 @@
     "description": "Someone edited a draft or published security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "repo_id",
-      "org_id",
       "business",
-      "actor",
-      "user_agent",
-      "created_at",
-      "_document_id",
       "business_id",
-      "repo",
-      "action",
-      "operation_type",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -12873,24 +19206,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -12899,24 +19238,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -12925,25 +19270,31 @@
     "description": "Code security was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -12952,25 +19303,31 @@
     "description": "Code security was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -12979,19 +19336,30 @@
     "description": "Data use settings were disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "repo_id",
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -13000,21 +19368,30 @@
     "description": "Data use settings were enabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "org",
-      "user_id",
-      "repo_id",
       "@timestamp",
-      "request_id",
-      "actor",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org_id",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -13023,23 +19400,30 @@
     "description": "The dependency graph was disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "repo_id",
-      "operation_type",
-      "user_id",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
-      "@timestamp",
-      "org_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -13048,24 +19432,31 @@
     "description": "The dependency graph was enabled for a private repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor_id",
-      "repo_id",
+      "created_at",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13074,21 +19465,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -13096,21 +19497,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13118,21 +19529,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -13140,20 +19562,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -13161,21 +19595,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13183,19 +19628,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -13203,17 +19661,31 @@
     "description": "An organization has reached their repository limit.",
     "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "limit",
       "count",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -13224,17 +19696,31 @@
     "description": "An organization is approaching their repository limit.",
     "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "limit",
       "count",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -13245,19 +19731,30 @@
     "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise  Organization owners can now control their repository projects settings.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "user_agent",
-      "user",
-      "business_id",
-      "business",
-      "operation_type",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -13266,20 +19763,30 @@
     "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
       "@timestamp",
-      "repo",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "repo_id",
-      "actor",
-      "request_id",
-      "programmatic_access_type"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13288,20 +19795,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
       "created_at",
-      "org_id",
-      "action",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "actor_id",
-      "repo"
+      "operation_type"
     ]
   },
   {
@@ -13309,31 +19825,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -13342,19 +19866,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -13362,8 +19897,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -13372,23 +19906,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -13413,26 +19956,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -13441,26 +19990,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -13469,23 +20024,30 @@
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13495,23 +20057,30 @@
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13521,24 +20090,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13548,24 +20124,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -13574,24 +20157,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13601,23 +20191,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13627,23 +20224,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -13652,22 +20257,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13675,24 +20288,32 @@
     "description": "Generic secrets have been disabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13700,22 +20321,31 @@
     "description": "Generic secrets have been enabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13724,24 +20354,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -13750,24 +20388,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -13776,19 +20422,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13797,24 +20455,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13823,24 +20489,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13849,19 +20523,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13870,26 +20556,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13898,26 +20589,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -13926,28 +20622,36 @@
     "description": "A code security configuration was applied to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -13955,27 +20659,35 @@
     "description": "A code security configuration failed to attach to the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -13983,28 +20695,36 @@
     "description": "A code security configuration was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14012,28 +20732,36 @@
     "description": "A code security configuration was removed due to a change in repository or enterprise settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14041,20 +20769,30 @@
     "description": "The repository visibility change setting was cleared for an organization or enterprise.",
     "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
       "business",
-      "action",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business_id",
-      "@timestamp",
       "user_agent",
-      "actor",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise"
   },
@@ -14063,20 +20801,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "org_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
-      "user_id",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14084,19 +20832,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "_document_id",
       "@timestamp",
-      "user_agent",
-      "user",
-      "created_at",
-      "org",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14104,29 +20863,37 @@
     "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -14135,29 +20902,37 @@
     "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -14166,19 +20941,32 @@
     "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
-      "operation_type",
-      "request_id",
-      "repo_id",
       "@timestamp",
-      "user_agent",
-      "alert_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "alert_id",
+      "created_at",
+      "alert_number"
     ],
     "docs_reference_titles": "About Dependabot alerts"
   },
@@ -14187,23 +20975,32 @@
     "description": "A Dependabot alert was manually dismissed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
+      "operation_type",
       "alert_id",
-      "actor",
-      "repo",
       "created_at",
-      "org",
-      "_document_id",
-      "action",
-      "actor_id",
       "dismiss_reason",
-      "user",
       "dismiss_comment",
       "alert_number",
       "actor_is_bot"
@@ -14214,21 +21011,33 @@
     "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "public_repo",
       "owner",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "token_scopes",
       "alert_number"
     ]
   },
@@ -14237,26 +21046,34 @@
     "description": "A Dependabot alert was manually reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo",
-      "alert_number",
-      "request_access_security_header"
+      "alert_number"
     ]
   },
   {
@@ -14264,21 +21081,32 @@
     "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "alert_id",
-      "repo",
-      "operation_type",
-      "action",
-      "repo_id",
-      "_document_id",
-      "user_agent",
-      "request_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "operation_type",
+      "created_at",
+      "alert_number"
     ]
   },
   {
@@ -14286,21 +21114,35 @@
     "description": "A Dependabot alert was withdrawn.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
       "created_at",
       "active",
-      "action",
-      "repository_id",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type"
     ]
   },
@@ -14309,20 +21151,30 @@
     "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
     "fields": [
-      "org",
+      "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
-      "operation_type",
-      "created_at",
-      "actor",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
   },
@@ -14331,24 +21183,31 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -14356,26 +21215,32 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14383,23 +21248,30 @@
     "description": "Dependabot alerts was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "request_id",
-      "repo_id",
-      "action",
-      "actor_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "_document_id",
       "user_id",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14407,23 +21279,30 @@
     "description": "Dependabot alerts was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_agent",
-      "created_at",
       "@timestamp",
-      "repo_id",
+      "_document_id",
       "action",
-      "user",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor_id",
-      "_document_id",
-      "user_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -14432,24 +21311,31 @@
     "description": "A status check was marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "org",
-      "actor_id",
       "@timestamp",
-      "business",
-      "request_id",
-      "context",
-      "repo_id",
-      "action",
-      "repo",
       "_document_id",
-      "operation_type",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "created_at",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "context",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -14458,21 +21344,31 @@
     "description": "A status check was no longer marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "actor_id",
-      "actor",
-      "created_at",
-      "context",
-      "operation_type",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "repo_id",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
       "repo",
-      "programmatic_access_type"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "context",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -14481,18 +21377,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -14501,19 +21410,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -14522,22 +21443,33 @@
     "description": "A new custom repository role was created.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "role_permissions",
       "old_role_permissions"
     ],
@@ -14548,23 +21480,34 @@
     "description": "A custom repository role was deleted.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing custom repository roles for an organization"
   },
@@ -14573,23 +21516,34 @@
     "description": "A custom repository role was edited.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "old_role_permissions",
       "old_base_role"
     ],
@@ -14600,14 +21554,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -14621,14 +21589,28 @@
     "description": "A secret scanning alert was leaked in a public repo.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -14643,22 +21625,32 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
@@ -14667,14 +21659,28 @@
     "description": "A leaked secret was reported to the secret's provider by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "created_at",
@@ -14689,28 +21695,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -14718,25 +21733,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -14744,14 +21766,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -14768,26 +21804,34 @@
     "description": "A request to close a secret scanning alert was approved by a user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "request_reviewer_comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14796,25 +21840,33 @@
     "description": "N/A",
     "docs_reference_links": "A reqeust to close a secret scanning alert was canceled by a user.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "A, reqeust, to, close, a, secret, scanning, alert, was, canceled, by, a, user."
@@ -14824,27 +21876,35 @@
     "description": "N/A",
     "docs_reference_links": "A user requested to close a secret scanning alert.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "reason",
       "comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "A, user, requested, to, close, a, secret, scanning, alert."
@@ -14854,26 +21914,34 @@
     "description": "A request to close a secret scanning alert was denied by a user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "request_reviewer_comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14882,19 +21950,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14903,19 +21982,30 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14924,20 +22014,30 @@
     "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14946,19 +22046,30 @@
     "description": "Secret scanning was enabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14967,14 +22078,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -14992,25 +22117,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -15019,24 +22152,32 @@
     "description": "A user canceled a request to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
@@ -15046,24 +22187,32 @@
     "description": "A user pushed a commit containing a secret for which there is an approved secret scanning push protection bypass request.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
@@ -15073,25 +22222,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -15101,25 +22258,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -15128,22 +22293,35 @@
     "description": "A secret scanning scan has completed on this repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "repo_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "source",
       "type",
       "source_slug",
       "type_slug",
       "started_at",
       "completed_at",
-      "repo",
       "public_repo",
-      "org",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "secret_types",
@@ -15157,10 +22335,28 @@
     "description": "A security configuration was created",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15175,15 +22371,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15201,22 +22390,33 @@
     "description": "A default security configuration setting for new repositories was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15225,22 +22425,33 @@
     "description": "A default security configuration setting for new repositories was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15249,10 +22460,28 @@
     "description": "A security configuration was deleted",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15267,15 +22496,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15292,15 +22514,30 @@
     "description": "A security configuration policy was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enforcement",
       "security_configuration_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15310,10 +22547,28 @@
     "description": "A security configuration was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15328,15 +22583,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15354,16 +22602,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15373,18 +22634,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -15393,16 +22667,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15412,15 +22699,28 @@
     "description": "An agreement for invoiced billing for GitHub Sponsors was signed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -15432,15 +22732,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -15450,15 +22763,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -15467,17 +22795,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -15486,17 +22827,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -15505,16 +22860,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -15524,14 +22892,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -15541,17 +22924,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -15559,18 +22955,31 @@
     "action": "sponsors.sponsored_developer_create",
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
-    "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
+    "fields": [
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -15579,18 +22988,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15599,15 +23021,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -15617,16 +23053,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15634,15 +23083,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -15653,16 +23115,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -15672,17 +23147,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -15693,17 +23181,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -15714,18 +23215,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15735,16 +23247,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15754,16 +23279,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15775,17 +23313,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15794,19 +23345,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15815,21 +23379,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "user",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
       "action",
-      "user_id",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "actor_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15838,19 +23411,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -15859,15 +23443,28 @@
     "description": "Dependabot encrypted config was read.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "public_repo"
@@ -15878,20 +23475,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15899,18 +23510,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -15918,16 +23544,31 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "domain_name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15935,23 +23576,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15959,23 +23610,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -15983,23 +23644,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16007,23 +23678,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16031,21 +23712,31 @@
     "description": "A member of an organization was added to a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
-      "user",
       "@timestamp",
-      "actor_id",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "org",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -16055,22 +23746,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -16079,20 +23779,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -16101,18 +23812,31 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
       "created_at",
       "operation_type",
-      "actor_id",
-      "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
@@ -16122,21 +23846,32 @@
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -16145,21 +23880,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -16168,19 +23913,31 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "team",
       "org_id",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
       "operation_type",
-      "_document_id",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -16189,19 +23946,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
       "business",
-      "action",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16209,19 +23977,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "request_id",
       "actor",
-      "org",
-      "created_at",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16229,18 +24008,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
       "@timestamp",
-      "action",
       "_document_id",
-      "user_agent",
-      "user_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -16249,19 +24039,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "actor",
-      "action",
-      "operation_type",
-      "team",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -16269,19 +24071,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "actor_id",
       "_document_id",
-      "team",
-      "created_at",
-      "org_id",
       "action",
-      "request_id",
-      "user_agent",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_access_security_header"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "team",
+      "created_at"
     ]
   },
   {
@@ -16289,22 +24103,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "team",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16312,22 +24135,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -16336,22 +24168,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -16359,23 +24200,33 @@
   {
     "action": "team.remove_repository",
     "description": "A repository was removed from a team's control.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "org",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -16383,21 +24234,32 @@
     "description": "A team's name was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "user_agent",
-      "created_at",
-      "team",
-      "operation_type",
-      "actor_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -16406,17 +24268,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -16425,19 +24300,30 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -16446,19 +24332,30 @@
     "description": "The Okta credentials for team synchronization with a tenant were changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -16466,28 +24363,37 @@
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
       "operation_type",
       "created_at",
-      "user_agent",
       "permission",
       "new_repo_permission",
       "new_repo_base_role",
       "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_repo_base_role"
     ]
   },
   {
@@ -16495,16 +24401,30 @@
     "description": "A Dependabot rule was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16514,16 +24434,30 @@
     "description": "A Dependabot rule was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16533,18 +24467,31 @@
     "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16554,21 +24501,33 @@
     "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -16576,21 +24535,32 @@
     "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -16598,21 +24568,32 @@
     "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -16620,16 +24601,30 @@
     "description": "A Dependabot rule's conditions, actions, or metadata changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16639,27 +24634,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -16668,23 +24669,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -16692,10 +24703,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -16706,20 +24735,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -16728,23 +24746,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16754,10 +24780,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -16769,19 +24813,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -16792,10 +24826,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -16804,21 +24856,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -16828,23 +24869,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -16853,22 +24906,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16876,21 +24940,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -16898,25 +24973,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16924,23 +25007,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -16954,24 +25050,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -16980,10 +25085,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -16993,21 +25116,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -17017,25 +25130,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.18/user.json b/src/audit-logs/data/ghes-3.18/user.json
index 9e80d3b859c4..759542980e5f 100644
--- a/src/audit-logs/data/ghes-3.18/user.json
+++ b/src/audit-logs/data/ghes-3.18/user.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,17 +67,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
-      "user_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -61,18 +98,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
+      "token_scopes",
       "user",
-      "request_id",
-      "_document_id",
-      "user_agent",
-      "actor",
       "user_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -80,18 +129,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "token_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -99,29 +160,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -129,18 +196,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -148,17 +227,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -167,19 +259,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -188,18 +292,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -207,18 +324,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -226,15 +355,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -244,26 +386,36 @@
     "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -271,24 +423,34 @@
     "description": "A CSV export was requested on the \"Coverage\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -296,26 +458,36 @@
     "description": "A CSV export was requested on the \"Overview Dashboard\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -323,20 +495,31 @@
     "description": "A CSV export was requested on the \"Risk\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -347,17 +530,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -368,20 +564,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -390,19 +598,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -411,19 +632,31 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -432,20 +665,32 @@
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -454,19 +699,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -475,20 +732,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -497,20 +765,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -521,17 +800,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -539,14 +830,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -556,25 +862,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -585,22 +900,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -612,22 +938,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -636,36 +973,64 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "public_repo"
-    ]
-  },
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "owner",
+      "created_at",
+      "operation_type",
+      "public_repo"
+    ]
+  },
   {
     "action": "codespaces.restore",
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -675,27 +1040,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "org",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -703,19 +1077,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -723,18 +1110,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -743,23 +1142,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -767,16 +1173,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -785,24 +1205,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -810,15 +1236,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -828,40 +1267,62 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "copilot.cfb_seat_cancelled",
-    "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "copilot.cfb_seat_cancelled",
+    "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -869,21 +1330,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -891,22 +1361,33 @@
     "description": "Specific repositories were disabled from using Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "owner_type",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -914,21 +1395,31 @@
     "description": "Specific repositories were enabled to use Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "owner_type",
-      "owner",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -938,20 +1429,32 @@
     "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_access",
       "old_access",
-      "org_id",
       "owner_type",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -961,21 +1464,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -985,19 +1497,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1007,21 +1528,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1031,19 +1561,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1052,19 +1593,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1073,19 +1625,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1094,19 +1657,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1115,17 +1689,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1133,19 +1720,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1154,19 +1752,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1174,19 +1783,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1195,19 +1815,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1215,40 +1846,62 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
-  },
-  {
-    "action": "dependency_graph.enable",
-    "description": "The dependency graph was enabled for all existing repositories.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+  },
+  {
+    "action": "dependency_graph.enable",
+    "description": "The dependency graph was enabled for all existing repositories.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1256,19 +1909,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1277,20 +1941,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1298,22 +1972,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1322,22 +2005,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1345,28 +2038,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1375,27 +2074,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1404,25 +2111,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1431,26 +2146,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1459,21 +2181,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1482,22 +2216,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1506,25 +2250,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1533,22 +2286,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1557,21 +2322,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -1582,21 +2357,32 @@
     "description": "A gist was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "gist_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "visibility",
-      "action",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ]
   },
   {
@@ -1604,20 +2390,32 @@
     "description": "A gist was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "gist_id",
-      "visibility",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "user",
-      "request_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "programmatic_access_type"
+      "gist_id",
+      "visibility",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1625,21 +2423,32 @@
     "description": "The visibility of a gist was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "user",
-      "gist_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "visibility",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "gist_id",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -1647,22 +2456,33 @@
     "description": "An SSH key was added to a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1671,23 +2491,34 @@
     "description": "An SSH key was removed from a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
       "explanation",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1696,23 +2527,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1720,18 +2560,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1742,20 +2592,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1765,18 +2625,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "user",
-      "operation_type",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1784,18 +2656,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1803,25 +2687,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -1829,52 +2723,70 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "created_at",
-      "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
+      "created_at",
+      "oauth_application_id",
+      "events"
+    ]
+  },
   {
     "action": "hook.create",
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -1883,25 +2795,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -1909,26 +2830,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -1936,21 +2866,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -1959,19 +2900,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -1979,21 +2933,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -2002,19 +2967,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -2025,20 +3004,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2048,24 +3039,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
-      "user_id",
-      "repository_selection",
-      "name",
-      "user",
-      "request_id",
-      "integration",
-      "operation_type",
-      "actor_id",
-      "action",
-      "repositories_added",
-      "created_at",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "repository_selection",
+      "name",
+      "integration",
+      "operation_type",
+      "repositories_added",
+      "created_at",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2076,23 +3078,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2103,20 +3117,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2126,19 +3153,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -2147,20 +3188,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -2170,20 +3224,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -2192,20 +3259,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -2214,20 +3294,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2235,40 +3327,66 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "name",
-      "integration",
-      "user",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "application_client_id"
-    ]
-  },
-  {
-    "action": "integration.revoke_tokens",
-    "description": "Token(s) for a GitHub App were revoked.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
+      "operation_type",
+      "created_at",
+      "application_client_id"
+    ]
+  },
+  {
+    "action": "integration.revoke_tokens",
+    "description": "Token(s) for a GitHub App were revoked.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2277,17 +3395,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2300,21 +3431,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -2328,17 +3472,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2350,18 +3507,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2369,21 +3538,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -2391,21 +3573,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2413,22 +3608,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -2436,19 +3644,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -2459,21 +3680,36 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
       "marketplace_listing",
       "has_free_trial",
-      "user_agent",
-      "request_id",
-      "actor_id",
       "yearly_price_in_cents",
       "description",
       "bullets",
       "monthly_price_in_cents",
-      "marketplace_listing_plan",
-      "_document_id"
+      "marketplace_listing_plan"
     ]
   },
   {
@@ -2481,22 +3717,37 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "marketplace_listing_plan",
       "marketplace_listing",
       "description",
       "bullets",
       "has_free_trial",
       "created_at",
-      "actor_id",
       "operation_type",
-      "_document_id",
-      "action",
-      "user_agent",
-      "request_id",
-      "actor",
       "monthly_price_in_cents",
-      "yearly_price_in_cents",
-      "@timestamp"
+      "yearly_price_in_cents"
     ]
   },
   {
@@ -2504,21 +3755,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "marketplace_listing_plan",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "marketplace_listing_plan",
       "description",
       "yearly_price_in_cents",
-      "@timestamp",
       "created_at",
-      "actor_id",
       "bullets",
       "has_free_trial",
       "marketplace_listing",
-      "user_agent",
       "monthly_price_in_cents",
-      "action",
       "operation_type"
     ]
   },
@@ -2527,21 +3793,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "monthly_price_in_cents",
-      "marketplace_listing",
+      "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "monthly_price_in_cents",
+      "marketplace_listing",
       "description",
       "bullets",
       "yearly_price_in_cents",
-      "request_id",
-      "actor_id",
       "has_free_trial",
       "marketplace_listing_plan",
-      "user_agent",
-      "@timestamp",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -2550,22 +3831,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -2573,22 +3867,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2596,19 +3903,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2616,21 +3935,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2640,16 +3968,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo_id",
-      "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
       "operation_type"
     ]
@@ -2659,18 +4000,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2680,14 +4034,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2695,19 +4065,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -2715,18 +4096,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2734,23 +4127,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -2758,20 +4159,30 @@
     "description": "An OAuth access token was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
     "fields": [
-      "_document_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "user",
-      "user_id",
-      "created_at",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "request_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
@@ -2782,19 +4193,30 @@
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "explanation",
-      "hashed_token",
-      "actor_id",
-      "token_scopes",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
@@ -2804,19 +4226,30 @@
     "description": "An OAuth access token was regenerated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "_document_id",
-      "created_at",
       "@timestamp",
-      "operation_type",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ]
   },
@@ -2825,16 +4258,28 @@
     "description": "An OAuth access token was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "request_access_security_header",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
       "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2844,18 +4289,30 @@
     "description": "An OAuth access token was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2863,20 +4320,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2885,20 +4354,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2907,20 +4388,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2929,20 +4422,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2951,19 +4456,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2972,20 +4490,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -2994,20 +4524,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3016,19 +4558,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3037,24 +4592,31 @@
     "description": "An authorization for an OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "user_id",
-      "actor",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
       "actor_id",
-      "user",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "actor_is_bot",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -3064,20 +4626,31 @@
     "description": "An authorization for an OAuth application was deleted.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "actor",
       "created_at",
       "explanation",
-      "user",
-      "user_id",
-      "org_id",
-      "action",
-      "actor_id",
-      "token_scopes",
       "actor_is_bot",
       "oauth_application_name"
     ],
@@ -3088,20 +4661,31 @@
     "description": "An authorization for an OAuth application was updated.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
-      "actor_id",
       "user_agent",
-      "@timestamp",
       "operation_type",
-      "action",
-      "user",
       "created_at",
-      "_document_id",
       "actor_is_bot",
-      "request_access_security_header",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -3111,21 +4695,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -3134,24 +4728,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3159,20 +4763,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3180,22 +4794,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3203,20 +4825,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3224,22 +4856,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3247,21 +4887,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3269,26 +4918,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -3297,26 +4955,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3324,28 +4990,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3353,26 +5027,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3380,20 +5062,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -3402,16 +5095,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -3422,18 +5128,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -3442,18 +5161,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -3462,18 +5193,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -3482,18 +5226,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -3503,20 +5259,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -3524,17 +5291,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -3544,20 +5324,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -3566,20 +5357,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -3588,17 +5393,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3609,20 +5429,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -3631,19 +5465,31 @@
     "description": "A new passkey was added.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3651,19 +5497,31 @@
     "description": "A new passkey was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3671,35 +5529,61 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "payment_method.remove",
-    "description": "A payment method was removed.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user",
-      "created_at",
-      "actor_id",
-      "@timestamp",
-      "user_id",
-      "action",
-      "operation_type",
-      "actor",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "payment_method.remove",
+    "description": "A payment method was removed.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
       "_document_id",
-      "request_access_security_header"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3707,18 +5591,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3726,18 +5622,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3748,18 +5657,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3770,17 +5692,30 @@
     "description": "Triggered when you create a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3790,19 +5725,31 @@
     "description": "Triggered when you regenerate a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3810,12 +5757,29 @@
     "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
     "fields": [
-      "user_programmatic_access_name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
       "operation_type"
     ],
@@ -3826,20 +5790,32 @@
     "description": "Triggered when you delete a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "explanation",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3847,17 +5823,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -3868,18 +5857,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -3891,17 +5893,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -3913,17 +5928,30 @@
     "description": "A fine-grained personal access token was updated.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3934,15 +5962,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3952,17 +5995,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3972,15 +6026,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3990,17 +6059,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4010,17 +6090,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4030,17 +6121,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4050,17 +6152,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4070,19 +6183,32 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
-      "request_id",
-      "user_agent",
+      "action",
       "actor",
-      "operation_type"
-    ],
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "owner",
+      "operation_type"
+    ],
     "docs_reference_titles": "Personalize your profile"
   },
   {
@@ -4090,17 +6216,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4108,20 +6247,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -4131,25 +6281,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -4157,20 +6319,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4178,25 +6352,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4204,17 +6390,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4222,17 +6421,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4240,18 +6452,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -4260,39 +6484,62 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
-  },
-  {
-    "action": "project.link",
-    "description": "A repository was linked to a project board.",
-    "docs_reference_links": "N/A",
-    "fields": [
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "actor_id",
-      "org_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
+  },
+  {
+    "action": "project.link",
+    "description": "A repository was linked to a project board.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "repo"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4300,17 +6547,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -4322,22 +6582,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -4345,19 +6614,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4365,17 +6645,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4383,18 +6676,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -4402,20 +6708,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4423,18 +6739,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -4443,36 +6771,61 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
-  },
-  {
-    "action": "project.visibility_private",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
+  },
+  {
+    "action": "project.visibility_private",
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -4484,21 +6837,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -4506,18 +6871,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4528,23 +6906,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -4553,24 +6942,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -4579,20 +6979,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4601,21 +7015,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -4625,22 +7052,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4649,25 +7088,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
-      "actor",
-      "key",
-      "fingerprint",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "fingerprint",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4676,23 +7125,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4701,22 +7161,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -4725,21 +7195,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -4748,25 +7227,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -4775,23 +7261,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -4800,24 +7294,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -4826,23 +7327,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -4852,22 +7361,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -4876,19 +7394,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -4897,24 +7428,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -4923,23 +7464,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4950,17 +7500,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -4969,15 +7532,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -4988,16 +7564,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -5007,17 +7596,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -5027,19 +7629,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -5048,17 +7661,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -5067,26 +7693,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -5095,30 +7727,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -5128,20 +7765,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5150,25 +7798,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5177,23 +7833,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5201,25 +7868,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -5229,23 +7905,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -5253,21 +7939,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5275,21 +7971,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -5297,22 +8003,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5320,21 +8035,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -5342,20 +8067,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5363,22 +8099,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5386,18 +8131,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5405,22 +8164,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5428,21 +8197,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5450,18 +8229,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -5470,48 +8261,65 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
-    ],
-    "docs_reference_titles": "Using secrets in GitHub Actions"
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Using secrets in GitHub Actions"
+  },
   {
     "action": "repo.remove_actions_variable",
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5520,23 +8328,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5544,26 +8362,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -5572,21 +8395,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -5595,25 +8427,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5621,22 +8459,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -5645,19 +8493,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5665,23 +8524,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -5691,20 +8559,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -5715,21 +8594,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -5738,22 +8628,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -5762,21 +8662,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -5785,22 +8696,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -5811,16 +8732,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -5829,22 +8761,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -5854,22 +8795,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -5878,23 +8830,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5904,41 +8866,61 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "repo.unarchived",
-    "description": "A repository was unarchived.",
-    "docs_reference_links": "/repositories/archiving-a-github-repository",
-    "fields": [
-      "actor",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "repo",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
+      "visibility"
+    ]
+  },
+  {
+    "action": "repo.unarchived",
+    "description": "A repository was unarchived.",
+    "docs_reference_links": "/repositories/archiving-a-github-repository",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -5947,24 +8929,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5972,25 +8963,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5999,24 +8997,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6025,25 +9033,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -6052,22 +9068,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6076,26 +9101,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -6103,31 +9136,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6136,21 +9176,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -6158,21 +9208,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6180,21 +9240,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -6202,20 +9273,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6223,21 +9306,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6245,19 +9339,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -6265,31 +9372,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -6298,19 +9413,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -6318,8 +9444,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -6328,23 +9453,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -6369,18 +9503,30 @@
     "description": "A security key was registered for an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6388,18 +9534,30 @@
     "description": "A security key was removed from an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6407,16 +9565,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6426,18 +9597,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -6446,16 +9630,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6466,15 +9663,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -6484,15 +9694,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -6501,17 +9726,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -6520,17 +9758,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -6539,33 +9791,61 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "created_at",
-      "user",
       "_document_id",
-      "user_agent",
-      "actor",
-      "operation_type"
-    ],
-    "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
-  },
-  {
-    "action": "sponsors.sponsor_sponsorship_tier_change",
-    "description": "A sponsorship was upgraded or downgraded.",
-    "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
-    "fields": [
-      "user_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "user",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
+  },
+  {
+    "action": "sponsors.sponsor_sponsorship_tier_change",
+    "description": "A sponsorship was upgraded or downgraded.",
+    "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -6575,17 +9855,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -6594,17 +9887,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -6613,18 +9919,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6633,15 +9952,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -6651,16 +9984,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6668,15 +10014,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -6687,16 +10046,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -6706,17 +10078,30 @@
     "description": "Triggered when you send an email update to your sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
     "fields": [
-      "request_id",
-      "actor",
-      "action",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
   },
@@ -6725,17 +10110,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -6746,17 +10144,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -6767,18 +10178,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6788,16 +10210,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6807,17 +10242,30 @@
     "description": "You join the waitlist to join GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "actor_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -6826,16 +10274,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6845,23 +10306,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6869,23 +10340,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6893,23 +10374,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -6917,39 +10408,64 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
-    ]
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
+      "public_repo",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
+    ]
+  },
   {
     "action": "successor_invitation.accept",
     "description": "Triggered when you accept a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6958,15 +10474,30 @@
     "description": "Triggered when you cancel a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6975,15 +10506,30 @@
     "description": "Triggered when you create a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -6992,15 +10538,30 @@
     "description": "Triggered when you decline a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7009,15 +10570,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7025,15 +10601,30 @@
     "description": "Triggered when you revoke a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7042,17 +10633,30 @@
     "description": "A new trusted device was added.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7060,17 +10664,30 @@
     "description": "A trusted device was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7078,14 +10695,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "action",
-      "request_id",
-      "user_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -7094,29 +10726,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "created_at",
-      "user_id",
-      "operation_type",
-      "user",
       "_document_id",
-      "user_agent",
-      "action"
-    ]
-  },
-  {
-    "action": "two_factor_account_recovery.ignore",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "two_factor_account_recovery.ignore",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "created_at",
-      "user_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7124,17 +10788,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "operation_type",
-      "action",
-      "_document_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7142,17 +10819,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7160,16 +10850,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7177,15 +10881,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "user",
       "_document_id",
-      "request_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7193,18 +10912,30 @@
     "description": "A secondary authentication factor was added to a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -7213,18 +10944,30 @@
     "description": "Two-factor authentication was disabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
     "fields": [
-      "actor",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_id",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Disabling two-factor authentication for your personal account"
   },
@@ -7233,18 +10976,30 @@
     "description": "Two-factor authentication was enabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
-      "actor",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Configuring two-factor authentication"
   },
@@ -7253,52 +11008,92 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user",
-      "user_id",
-      "action",
       "@timestamp",
-      "request_id",
-      "_document_id",
-      "user_agent"
-    ]
-  },
-  {
-    "action": "two_factor_authentication.recovery_codes_regenerated",
-    "description": "Two factor recovery codes were regenerated for a user account.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
-      "user_id",
       "action",
-      "user",
-      "user_agent",
+      "actor",
       "actor_id",
-      "@timestamp",
-      "created_at"
-    ]
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "two_factor_authentication.recovery_codes_regenerated",
+    "description": "Two factor recovery codes were regenerated for a user account.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "two_factor_authentication.remove_factor",
     "description": "A secondary authentication factor was removed from a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -7307,15 +11102,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "created_at",
-      "_document_id",
-      "action",
-      "@timestamp"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7324,16 +11134,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "operation_type",
       "user_agent",
-      "action",
-      "request_id",
-      "actor",
-      "actor_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7341,19 +11164,31 @@
     "description": "An email address was added to a user account.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "actor_id",
-      "actor",
       "email",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding an email address to your GitHub account"
   },
@@ -7362,18 +11197,30 @@
     "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "created_at",
-      "user",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7381,15 +11228,28 @@
     "description": "Audit log entries were exported.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "action",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ]
@@ -7399,20 +11259,31 @@
     "description": "A user was blocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_id",
-      "_document_id",
       "actor_id",
-      "@timestamp",
-      "user_agent",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7420,18 +11291,30 @@
     "description": "A user changed their password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "actor_id",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7439,18 +11322,30 @@
     "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -7459,17 +11354,30 @@
     "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -7478,19 +11386,31 @@
     "description": "A new user account was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "email",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "created_at",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "programmatic_access_type"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "email",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7498,21 +11418,33 @@
     "description": "A user secret for Codespaces was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7520,20 +11452,31 @@
     "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "oauth_application_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "@timestamp",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -7541,18 +11484,30 @@
     "description": "A user account was destroyed by an asynchronous job.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7561,19 +11516,30 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "oauth_application_id",
+      "_document_id",
       "action",
-      "user",
-      "created_at",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7581,18 +11547,30 @@
     "description": "A user deleted his or her account, triggering user.async_delete.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
-      "created_at",
-      "user_agent",
       "user_id",
-      "operation_type",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7600,18 +11578,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "user_agent",
       "user_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7619,37 +11609,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "actor_id",
+      "_document_id",
       "action",
-      "request_access_security_header"
-    ]
-  },
-  {
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
     "action": "user.device_verification_success",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "request_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7657,17 +11671,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7675,17 +11702,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7693,17 +11733,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7711,21 +11764,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7733,21 +11796,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -7756,17 +11829,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7774,17 +11860,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7792,17 +11891,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7810,36 +11922,62 @@
     "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "org_id",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent"
-    ]
-  },
-  {
-    "action": "user.forgot_password",
-    "description": "A user requested a password reset.",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "user.forgot_password",
+    "description": "A user requested a password reset.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
     "fields": [
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "email",
-      "created_at",
-      "user_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
   },
@@ -7848,17 +11986,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "created_at",
-      "user_agent",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "request_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7866,18 +12017,30 @@
     "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -7886,19 +12049,31 @@
     "description": "A user signed in.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "actor_id",
       "@timestamp",
-      "user",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "actor",
-      "passkey_nickname",
-      "request_access_security_header"
+      "passkey_nickname"
     ]
   },
   {
@@ -7906,18 +12081,30 @@
     "description": "A user signed out.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7925,18 +12112,30 @@
     "description": "A user signed in from a new device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7944,21 +12143,31 @@
     "description": "An ordinary user account was promoted to a site administrator.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
+      "user_id",
       "user_agent",
+      "created_at",
       "oauth_application_id",
-      "request_id",
-      "operation_type",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7966,16 +12175,29 @@
     "description": "A user's account was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user",
-      "action",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "operation_type"
     ]
   },
@@ -7984,20 +12206,31 @@
     "description": "An email address was removed from a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "actor_id",
       "created_at",
-      "email",
-      "token_scopes",
-      "programmatic_access_type"
+      "email"
     ]
   },
   {
@@ -8005,20 +12238,32 @@
     "description": "A user secret for Codespaces was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "key",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8026,20 +12271,31 @@
     "description": "A username was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "request_id",
-      "actor_id",
-      "old_login",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_login",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8047,18 +12303,30 @@
     "description": "A user reset their account password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8066,16 +12334,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -8086,16 +12367,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -8104,18 +12397,30 @@
     "description": "A user signed in from an unrecognized device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor",
-      "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8123,18 +12428,30 @@
     "description": "A user signed in from an unrecognized device and location.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "created_at",
-      "_document_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8142,22 +12459,33 @@
     "description": "Triggered when you clear the status on your profile.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "message",
-      "user",
-      "actor_id",
       "created_at",
-      "request_id",
       "limited_availability",
-      "action",
       "emoji",
-      "operation_type",
-      "user_agent",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8165,23 +12493,33 @@
     "description": "Triggered when you set or change the status on your profile.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
     "fields": [
-      "limited_availability",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "message",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "limited_availability",
+      "message",
+      "created_at",
       "emoji",
-      "org",
-      "actor",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
   },
@@ -8190,21 +12528,31 @@
     "description": "A user account was suspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "user_agent",
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "token_scopes",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8212,18 +12560,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
-      "actor_id",
       "@timestamp",
-      "operation_type",
       "_document_id",
-      "user_agent",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8231,18 +12591,30 @@
     "description": "A 2FA challenge issued for a user account failed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "actor_id",
-      "actor",
-      "user_id",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8252,16 +12624,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
       "user_agent",
-      "request_id",
-      "action",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8269,18 +12653,30 @@
     "description": "A user used their 2FA recovery codes.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8288,18 +12684,30 @@
     "description": "A user downloaded 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8307,17 +12715,30 @@
     "description": "A user printed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8325,18 +12746,30 @@
     "description": "A user viewed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
       "created_at",
-      "user",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8344,17 +12777,30 @@
     "description": "A user was prompted for a two-factor authentication code.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
     "fields": [
-      "user",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "actor"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
   },
@@ -8363,19 +12809,31 @@
     "description": "A user was unblocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "user_agent",
-      "user_id",
-      "user",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8383,21 +12841,31 @@
     "description": "A user account was unsuspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "user_agent",
       "actor",
-      "oauth_application_id",
-      "operation_type",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "user_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8405,21 +12873,33 @@
     "description": "A user secret for Codespaces was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8427,46 +12907,64 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "workflows.approve_workflow_job",
+    "description": "A workflow job was approved.",
+    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "workflows.approve_workflow_job",
-    "description": "A workflow job was approved.",
-    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
-    "fields": [
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "workflow_run_id",
       "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -8475,23 +12973,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8499,23 +13007,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8525,23 +13041,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -8550,22 +13078,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8573,21 +13112,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -8595,25 +13145,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8621,24 +13179,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -8647,25 +13214,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.19/enterprise.json b/src/audit-logs/data/ghes-3.19/enterprise.json
index a25304cad3e2..956618cc9302 100644
--- a/src/audit-logs/data/ghes-3.19/enterprise.json
+++ b/src/audit-logs/data/ghes-3.19/enterprise.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,17 +67,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
-      "user_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -61,18 +98,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
+      "token_scopes",
       "user",
-      "request_id",
-      "_document_id",
-      "user_agent",
-      "actor",
       "user_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -80,18 +129,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "token_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -99,29 +160,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -129,31 +196,34 @@
     "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "query_string",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "request_body",
-      "status_code",
-      "url_path",
       "business",
       "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "request_method",
+      "query_string",
+      "request_body",
+      "status_code",
+      "url_path",
+      "public_repo",
       "created_at",
       "operation_type",
       "route",
@@ -167,18 +237,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -186,20 +268,32 @@
     "description": "A manual check of the endpoint configured for audit log streaming was performed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "audit_log_stream_result",
-      "business_id",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_result",
       "created_at",
       "operation_type",
-      "audit_log_stream_sink_details",
-      "request_access_security_header"
+      "audit_log_stream_sink_details"
     ]
   },
   {
@@ -207,18 +301,31 @@
     "description": "An endpoint was added for audit log streaming.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "business_id",
       "business",
-      "audit_log_stream_sink",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_sink",
+      "created_at",
+      "operation_type",
       "audit_log_stream_id"
     ]
   },
@@ -227,15 +334,28 @@
     "description": "An audit log streaming endpoint was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "business_id",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "audit_log_stream_id",
@@ -247,17 +367,30 @@
     "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "audit_log_stream_enabled",
-      "business_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_enabled",
       "audit_log_stream_sink",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "new_s3_bucket",
@@ -280,21 +413,34 @@
     "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -310,22 +456,34 @@
     "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "uuid",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -333,25 +491,37 @@
     "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
-      "request_access_security_header",
       "old_target_amount",
       "old_budget_limit_type",
       "old_alert_enabled",
@@ -365,17 +535,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -384,19 +567,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -405,15 +600,28 @@
     "description": "Azure subscription has been linked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -423,15 +631,28 @@
     "description": "Azure subscription has been unlinked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -441,18 +662,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
-      "user",
-      "user_id",
-      "user_agent",
-      "created_at",
-      "action"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -460,18 +694,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -479,15 +725,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -497,22 +756,31 @@
     "description": "An enterprise owner was added to an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
     "fields": [
-      "name",
-      "business",
-      "user",
-      "user_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "request_id",
+      "business",
       "business_id",
-      "_document_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Inviting people to manage your enterprise"
   },
@@ -521,22 +789,32 @@
     "description": "An organization was added to an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "operation_type",
       "name",
       "created_at",
-      "request_id",
-      "_document_id",
-      "business",
-      "organization_upgrade",
-      "request_access_security_header"
+      "organization_upgrade"
     ]
   },
   {
@@ -544,20 +822,30 @@
     "description": "GitHub Advanced Security was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -566,17 +854,28 @@
     "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -587,21 +886,31 @@
     "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -610,17 +919,28 @@
     "description": "GitHub Advanced Security was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -631,17 +951,28 @@
     "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -652,21 +983,31 @@
     "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -675,20 +1016,32 @@
     "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "new_policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "new_policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -697,20 +1050,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -718,17 +1083,28 @@
     "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -740,21 +1116,31 @@
     "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -763,18 +1149,31 @@
     "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -783,17 +1182,30 @@
     "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
     "fields": [
-      "name",
-      "operation_type",
-      "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "actor",
+      "@timestamp",
       "_document_id",
-      "business",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -803,19 +1215,32 @@
     "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
-      "action",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "business",
       "visibility",
       "created_at",
-      "actor",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -824,21 +1249,33 @@
     "description": "The policy for Code scanning autofix was updated for an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -846,21 +1283,33 @@
     "description": "The policy for Code scanning autofix third party tools was updated for an enterprise.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/getting-started/github-security-features#available-with-github-code-security"
   },
@@ -869,18 +1318,30 @@
     "description": "The policy for Code Security enablement was updated for an enterprise.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -892,19 +1353,31 @@
     "description": "An enterprise was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "request_id",
-      "name",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "operation_type",
-      "actor",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -912,17 +1385,28 @@
     "description": "Dependabot alerts were disabled for new repositories in your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -932,17 +1416,28 @@
     "description": "Dependabot alerts were enabled for new repositories in your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -952,17 +1447,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -972,18 +1480,30 @@
     "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -991,17 +1511,28 @@
     "description": "Display of IP addresses within audit log events for the enterprise was disabled.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1012,18 +1543,31 @@
     "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "business_id",
-      "actor_id",
-      "name",
-      "_document_id",
-      "request_id"
+      "name"
     ]
   },
   {
@@ -1031,15 +1575,28 @@
     "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1049,17 +1606,28 @@
     "description": "Display of IP addresses within audit log events for the enterprise was enabled.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1070,18 +1638,31 @@
     "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "operation_type",
-      "created_at",
+      "actor_id",
       "business",
       "business_id",
-      "name",
-      "_document_id",
-      "request_id",
-      "@timestamp"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ]
   },
   {
@@ -1089,20 +1670,31 @@
     "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
       "business",
-      "name",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "business_id",
-      "_document_id"
+      "created_at",
+      "name",
+      "operation_type"
     ]
   },
   {
@@ -1110,20 +1702,31 @@
     "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1131,20 +1734,31 @@
     "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "business",
-      "actor_id",
-      "created_at",
-      "action",
+      "user_id",
       "user_agent",
-      "request_id",
-      "user_id"
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1152,20 +1766,31 @@
     "description": "An enterprise owner was removed from an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
-      "user_agent",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "name",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
-      "user"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ],
     "docs_reference_titles": "Inviting people to manage your enterprise"
   },
@@ -1174,20 +1799,31 @@
     "description": "An organization was removed from an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "business",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "business_id",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "name",
-      "org"
+      "name"
     ]
   },
   {
@@ -1195,18 +1831,31 @@
     "description": "The slug for the enterprise URL was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "name",
-      "business_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
-      "@timestamp",
-      "created_at",
+      "actor_id",
       "business",
-      "_document_id"
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1214,20 +1863,31 @@
     "description": "The SAML single sign-on session for a member in an enterprise was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "_document_id",
-      "actor_id",
       "name",
-      "@timestamp",
-      "user_id",
-      "action",
-      "created_at",
-      "business"
+      "created_at"
     ]
   },
   {
@@ -1235,17 +1895,28 @@
     "description": "Automatic partner validation checks have been disabled at the business level",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1256,17 +1927,28 @@
     "description": "Automatic partner validation checks have been enabled at the business level",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1277,20 +1959,30 @@
     "description": "An enterprise-level custom pattern was created for secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -1299,17 +1991,28 @@
     "description": "An enterprise-level custom pattern was removed from secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1319,20 +2022,30 @@
     "description": "An enterprise-level custom pattern was published for secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1340,17 +2053,28 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1361,20 +2085,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -1383,17 +2117,28 @@
     "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1403,17 +2148,28 @@
     "description": "Secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1424,17 +2180,28 @@
     "description": "Secret scanning was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1445,17 +2212,28 @@
     "description": "Secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1466,17 +2244,28 @@
     "description": "Secret scanning was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1487,39 +2276,61 @@
     "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "actor_is_bot"
-    ],
-    "docs_reference_titles": "Supported secret scanning patterns"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
+    ],
+    "docs_reference_titles": "Supported secret scanning patterns"
   },
   {
     "action": "business_secret_scanning_non_provider_patterns.enabled",
     "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1531,17 +2342,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1552,17 +2374,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1573,17 +2406,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1594,17 +2438,28 @@
     "description": "Push protection for secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1615,17 +2470,28 @@
     "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1636,17 +2502,28 @@
     "description": "Push protection for secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1657,17 +2534,28 @@
     "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1678,10 +2566,28 @@
     "description": "The push protection setting was updated for a secret type for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "push_protection_setting",
       "secret_type",
       "secret_type_display_name",
@@ -1694,10 +2600,28 @@
     "description": "The push protection pattern configuration was updated for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
@@ -1707,20 +2631,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "new_policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "new_policy",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1728,26 +2664,36 @@
     "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1755,24 +2701,34 @@
     "description": "A CSV export was requested on the \"Coverage\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1780,26 +2736,36 @@
     "description": "A CSV export was requested on the \"Overview Dashboard\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1807,20 +2773,31 @@
     "description": "A CSV export was requested on the \"Risk\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1831,17 +2808,29 @@
     "description": "The cache retention policy for GitHub Actions was set for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1853,17 +2842,29 @@
     "description": "The cache storage policy for GitHub Actions was set for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1875,17 +2876,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -1896,20 +2910,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1918,19 +2944,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1939,41 +2978,65 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
   {
     "action": "business.set_fork_pr_workflows_policy",
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1982,19 +3045,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -2003,20 +3078,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "issuer",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
       "business_id",
-      "actor_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "issuer",
+      "name",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2024,18 +3111,31 @@
     "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "updated_github_owned_allowed",
       "updated_verified_allowed",
       "updated_patterns",
@@ -2050,20 +3150,33 @@
     "description": "The base repository permission setting was updated for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
     "fields": [
-      "business_id",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "permission",
-      "action",
       "created_at",
-      "@timestamp",
-      "request_id",
       "name",
-      "_document_id",
-      "old_permission",
-      "business"
+      "old_permission"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -2072,19 +3185,32 @@
     "description": "The repository creation setting was updated for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "name",
-      "business_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "operation_type",
-      "permission",
-      "action",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "name",
+      "operation_type",
+      "permission",
       "visibility"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -2094,19 +3220,32 @@
     "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories",
     "fields": [
-      "business_id",
-      "created_at",
-      "action",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "permission",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "business"
+      "created_at",
+      "operation_type",
+      "permission",
+      "name"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -2115,20 +3254,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -2137,20 +3287,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
-      "user",
-      "user_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -2161,17 +3322,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2179,15 +3352,31 @@
     "description": "Existing code scanning alerts appeared in a branch.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2197,15 +3386,31 @@
     "description": "Code scanning alerts were fixed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2215,15 +3420,31 @@
     "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_numbers",
       "commit_oid",
-      "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business"
+      "ref"
     ],
     "docs_reference_titles": "About code scanning"
   },
@@ -2232,15 +3453,29 @@
     "description": "Code scanning alerts were manually dismissed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers",
       "dismissal_approver_id"
     ],
@@ -2251,19 +3486,31 @@
     "description": "Dismissal of code scanning alerts was approved.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2274,19 +3521,31 @@
     "description": "Dismissal of code scanning alerts was denied.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2297,19 +3556,31 @@
     "description": "Dismissal of code scanning alerts was requested.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2320,13 +3591,31 @@
     "description": "Code scanning alerts were seen for the first time.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2336,15 +3625,31 @@
     "description": "Code scanning alerts that were previously fixed reappeared.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "commit_oid",
-      "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
+      "commit_oid",
+      "ref",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2354,15 +3659,29 @@
     "description": "Code scanning alerts that were previously dismissed were reopened.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2372,14 +3691,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2389,25 +3723,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -2418,22 +3761,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -2445,22 +3799,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -2469,15 +3834,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -2488,17 +3868,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2508,27 +3901,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "org",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2536,19 +3938,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "owner",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
+      "operation_type",
+      "created_at",
+      "public_repo"
     ]
   },
   {
@@ -2556,18 +3971,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -2576,23 +4003,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2600,16 +4034,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -2618,24 +4066,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2643,15 +4097,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2661,20 +4128,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2682,19 +4159,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -2702,21 +4191,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -2724,22 +4222,33 @@
     "description": "Specific repositories were disabled from using Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "owner_type",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -2747,21 +4256,31 @@
     "description": "Specific repositories were enabled to use Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "owner_type",
-      "owner",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2771,20 +4290,32 @@
     "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_access",
       "old_access",
-      "org_id",
       "owner_type",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2794,21 +4325,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2818,19 +4358,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2840,21 +4389,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2864,18 +4422,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -2888,18 +4459,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -2913,14 +4497,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -2933,8 +4532,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2943,27 +4541,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2972,19 +4578,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2993,16 +4611,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "definition_id"
@@ -3014,19 +4645,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -3035,19 +4677,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -3056,19 +4709,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -3077,19 +4741,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -3098,21 +4773,31 @@
     "description": "The default repository access for Dependabot was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "access_level",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -3121,17 +4806,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3139,19 +4837,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -3160,39 +4869,61 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
-    ]
-  },
-  {
-    "action": "dependabot_security_updates_new_repos.disable",
-    "description": " Dependabot security updates were disabled for all new repositories.",
-    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
-    "fields": [
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "dependabot_security_updates_new_repos.disable",
+    "description": " Dependabot security updates were disabled for all new repositories.",
+    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -3201,19 +4932,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3221,19 +4963,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -3242,19 +4995,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3262,19 +5026,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -3283,20 +5058,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3304,21 +5089,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "team",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "number",
-      "org",
-      "title",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id"
+      "team",
+      "created_at",
+      "number",
+      "title",
+      "operation_type"
     ]
   },
   {
@@ -3326,18 +5123,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user_id",
-      "actor",
       "number",
-      "user",
-      "created_at",
-      "request_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3345,18 +5155,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "_document_id",
-      "request_id",
-      "org",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "user",
-      "user_id",
-      "org_id",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "number",
       "team",
       "created_at"
@@ -3367,21 +5188,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "_document_id",
-      "title",
-      "user",
-      "user_agent",
-      "org",
-      "operation_type",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "team",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type",
+      "team",
       "number"
     ]
   },
@@ -3390,17 +5222,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3411,16 +5257,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3431,18 +5291,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
       "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3453,23 +5327,31 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise"
   },
@@ -3478,19 +5360,33 @@
     "description": "A domain was approved for an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3499,18 +5395,33 @@
     "description": "A domain was added to an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3519,18 +5430,33 @@
     "description": "A domain was removed from an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3539,18 +5465,33 @@
     "description": "A domain was verified for an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3559,18 +5500,30 @@
     "description": "A new GitHub Actions self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -3579,20 +5532,30 @@
     "description": "A GitHub Actions self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -3601,20 +5564,30 @@
     "description": "An enterprise role was assigned to a user or enterprise team.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "enterprise_role_id",
-      "enterprise_role_name",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "enterprise_role_id",
+      "enterprise_role_name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3626,20 +5599,32 @@
     "description": "A custom enterprise role was created in an enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3651,20 +5636,32 @@
     "description": "A custom enterprise role was deleted in an enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3676,20 +5673,30 @@
     "description": "A user or enterprise team was unassigned an enterprise role.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "enterprise_role_id",
-      "enterprise_role_name",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "enterprise_role_id",
+      "enterprise_role_name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3701,21 +5708,33 @@
     "description": "A custom enterprise role was edited in an enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
       "old_role_permissions",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3727,18 +5746,31 @@
     "description": "A GitHub Actions self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
@@ -3748,18 +5780,31 @@
     "description": "A GitHub Actions self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3768,41 +5813,66 @@
     "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
-      "runner_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
-  },
-  {
-    "action": "enterprise.runner_group_runners_added",
-    "description": "A GitHub Actions self-hosted runner was added to a group.",
-    "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
-    "fields": [
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
+      "runner_id",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
+  },
+  {
+    "action": "enterprise.runner_group_runners_added",
+    "description": "A GitHub Actions self-hosted runner was added to a group.",
+    "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3811,19 +5881,32 @@
     "description": "A GitHub Actions runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -3832,24 +5915,36 @@
     "description": "The configuration of a GitHub Actions self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3858,14 +5953,32 @@
     "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -3874,14 +5987,32 @@
     "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -3890,18 +6021,36 @@
     "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
       "target_version",
       "runner_group_id",
       "runner_group_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Self-hosted runners"
   },
@@ -3910,22 +6059,32 @@
     "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "business_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "user",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3933,21 +6092,33 @@
     "description": "A license for GitHub Copilot was assigned to an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3955,38 +6126,64 @@
     "description": "A license for GitHub Copilot was unassigned from an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "business_id",
-      "enterprise_team_id",
-      "enterprise_team",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "actor_is_bot"
-    ]
-  },
-  {
-    "action": "enterprise_team.create",
-    "description": "A new enterprise team was created.",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "enterprise_team_id",
+      "enterprise_team",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
+    ]
+  },
+  {
+    "action": "enterprise_team.create",
+    "description": "A new enterprise team was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3996,17 +6193,30 @@
     "description": "An enterprise team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4017,22 +6227,32 @@
     "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "business_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "user",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4040,18 +6260,31 @@
     "description": "The name of an enterprise team was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "business_id",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4062,22 +6295,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -4086,22 +6328,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4109,28 +6361,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -4139,27 +6397,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -4168,25 +6434,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -4195,26 +6469,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -4223,21 +6504,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -4246,22 +6539,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -4270,25 +6573,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -4297,22 +6609,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -4321,21 +6645,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -4346,27 +6680,33 @@
     "description": "A user was added to an external group.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "external_group",
-      "external_group_id",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "external_group",
+      "external_group_id",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -4374,43 +6714,66 @@
     "description": "An external group was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
-      "scim_group_id"
-    ]
-  },
-  {
-    "action": "external_group.link",
-    "description": "An external group was linked to a GitHub team.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "external_group_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
+      "scim_group_id"
+    ]
+  },
+  {
+    "action": "external_group.link",
+    "description": "An external group was linked to a GitHub team.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "external_group",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "scim_group_id",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "external_group_id",
+      "operation_type",
+      "created_at",
+      "external_group",
+      "scim_group_id"
     ]
   },
   {
@@ -4418,21 +6781,31 @@
     "description": "An external group was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4440,26 +6813,32 @@
     "description": "A user was removed from an external group.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "external_group",
-      "external_group_id",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "external_group",
+      "external_group_id",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4467,15 +6846,29 @@
     "description": "Failed external group SCIM API request.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
@@ -4483,15 +6876,9 @@
       "url_path",
       "scim_group_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4500,30 +6887,38 @@
     "description": "Successful external group SCIM API request. Excludes GET API requests.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4532,18 +6927,31 @@
     "description": "An external group was unlinked to a GitHub team.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "external_group"
     ]
   },
@@ -4552,22 +6960,32 @@
     "description": "An external group was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "scim_group_id",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at",
+      "scim_group_id"
     ]
   },
   {
@@ -4575,25 +6993,33 @@
     "description": "An external group's display name was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
       "external_group",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -4601,20 +7027,31 @@
     "description": "An external identity was deprovisioned, suspending the linked GitHub user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -4622,17 +7059,31 @@
     "description": "An external identity was created and linked to a GitHub user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "scim_user_id",
-      "request_access_security_header"
+      "scim_user_id"
     ]
   },
   {
@@ -4640,15 +7091,29 @@
     "description": "Failed external identity SCIM API request.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
@@ -4656,15 +7121,9 @@
       "url_path",
       "scim_user_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4673,30 +7132,38 @@
     "description": "Successful external identity SCIM API request. Excludes GET API requests.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4705,18 +7172,31 @@
     "description": "An external identity was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "scim_user_id",
-      "request_access_security_header"
+      "scim_user_id"
     ]
   },
   {
@@ -4724,21 +7204,32 @@
     "description": "A gist was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "gist_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "visibility",
-      "action",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ]
   },
   {
@@ -4746,20 +7237,32 @@
     "description": "A gist was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "gist_id",
-      "visibility",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "user",
-      "request_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "programmatic_access_type"
+      "gist_id",
+      "visibility",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4767,21 +7270,32 @@
     "description": "The visibility of a gist was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "user",
-      "gist_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "visibility",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "gist_id",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -4789,20 +7303,31 @@
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "user",
-      "user_id",
-      "transport_protocol_name"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
+      "transport_protocol_name"
     ]
   },
   {
@@ -4810,20 +7335,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4832,19 +7367,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4853,22 +7399,33 @@
     "description": "An SSH key was added to a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -4877,23 +7434,34 @@
     "description": "An SSH key was removed from a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
       "explanation",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -4902,23 +7470,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4926,18 +7503,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4948,20 +7535,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -4971,18 +7568,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "user",
-      "operation_type",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4990,18 +7599,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5009,25 +7630,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -5035,25 +7666,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -5061,26 +7701,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -5089,25 +7738,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -5115,26 +7773,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -5142,21 +7809,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -5165,19 +7843,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -5185,21 +7876,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -5208,43 +7910,69 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
-      "request_id",
-      "repository_selection",
-      "user_id",
-      "action",
-      "user_agent",
-      "user",
-      "created_at",
-      "integration",
       "_document_id",
-      "programmatic_access_type",
-      "application_client_id"
-    ],
-    "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
-  },
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "repository_selection",
+      "created_at",
+      "integration",
+      "application_client_id"
+    ],
+    "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
+  },
   {
     "action": "integration_installation.destroy",
     "description": "A GitHub App was uninstalled.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -5254,24 +7982,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -5282,23 +8021,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -5309,21 +8060,33 @@
     "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
       "operation_type",
-      "@timestamp",
       "integration",
-      "action",
-      "user_agent",
       "reason",
-      "_document_id",
-      "org",
-      "org_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -5334,20 +8097,32 @@
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
       "@timestamp",
-      "actor_id",
-      "org",
       "_document_id",
-      "requester",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "requester",
       "created_at",
       "url",
-      "org_id",
-      "request_id",
       "operation_type",
-      "actor",
       "integration",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -5357,20 +8132,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -5380,19 +8168,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -5401,20 +8203,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -5424,20 +8239,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -5446,20 +8274,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -5468,20 +8309,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5489,19 +8342,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -5510,19 +8376,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -5531,17 +8410,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -5554,21 +8446,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -5582,17 +8487,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -5604,19 +8522,30 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "user"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5624,19 +8553,30 @@
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5644,17 +8584,28 @@
     "description": "IP allow list user level enforcement was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5664,20 +8615,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "user_id",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
-      "_document_id",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "actor_id",
       "operation_type",
-      "org",
       "created_at"
     ]
   },
@@ -5686,19 +8646,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5706,17 +8677,28 @@
     "description": "IP allow list user level enforcement was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5726,24 +8708,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5751,24 +8741,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "ip_allow_list_entry",
-      "org",
-      "operation_type",
-      "created_at",
-      "active",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at",
+      "active"
     ]
   },
   {
@@ -5776,19 +8774,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "actor_id",
       "ip_allow_list_entry",
-      "active",
-      "org_id",
-      "@timestamp"
+      "active"
     ]
   },
   {
@@ -5796,20 +8807,30 @@
     "description": "An issue was marked as blocked by another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5820,19 +8841,30 @@
     "description": "The blocked by relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
+      "public_repo",
       "created_at",
       "operation_type"
     ]
@@ -5842,20 +8874,30 @@
     "description": "An issue was marked as blocking another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5866,20 +8908,30 @@
     "description": "The blocking relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5890,18 +8942,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5909,21 +8973,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -5931,21 +9008,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5953,22 +9043,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -5976,19 +9079,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -5999,21 +9115,36 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
       "marketplace_listing",
       "has_free_trial",
-      "user_agent",
-      "request_id",
-      "actor_id",
       "yearly_price_in_cents",
       "description",
       "bullets",
       "monthly_price_in_cents",
-      "marketplace_listing_plan",
-      "_document_id"
+      "marketplace_listing_plan"
     ]
   },
   {
@@ -6021,44 +9152,74 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "marketplace_listing_plan",
-      "marketplace_listing",
-      "description",
-      "bullets",
-      "has_free_trial",
-      "created_at",
-      "actor_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "user_agent",
-      "request_id",
-      "actor",
-      "monthly_price_in_cents",
-      "yearly_price_in_cents",
-      "@timestamp"
-    ]
-  },
-  {
-    "action": "marketplace_listing_plan.retire",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "marketplace_listing_plan",
+      "marketplace_listing",
+      "description",
+      "bullets",
+      "has_free_trial",
+      "created_at",
+      "operation_type",
+      "monthly_price_in_cents",
+      "yearly_price_in_cents"
+    ]
+  },
+  {
+    "action": "marketplace_listing_plan.retire",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "marketplace_listing_plan",
       "description",
       "yearly_price_in_cents",
-      "@timestamp",
       "created_at",
-      "actor_id",
       "bullets",
       "has_free_trial",
       "marketplace_listing",
-      "user_agent",
       "monthly_price_in_cents",
-      "action",
       "operation_type"
     ]
   },
@@ -6067,21 +9228,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "monthly_price_in_cents",
-      "marketplace_listing",
+      "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "monthly_price_in_cents",
+      "marketplace_listing",
       "description",
       "bullets",
       "yearly_price_in_cents",
-      "request_id",
-      "actor_id",
       "has_free_trial",
       "marketplace_listing_plan",
-      "user_agent",
-      "@timestamp",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -6090,22 +9266,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -6113,22 +9302,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6136,19 +9338,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6156,21 +9370,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6180,16 +9403,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6199,18 +9435,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6220,34 +9469,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
-      "operation_type",
-      "created_at",
-      "request_access_security_header"
-    ]
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "metered_billing_configuration.destroy",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -6255,18 +9531,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6274,23 +9562,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -6298,20 +9594,30 @@
     "description": "An OAuth access token was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
     "fields": [
-      "_document_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "user",
-      "user_id",
-      "created_at",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "request_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
@@ -6322,19 +9628,30 @@
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "explanation",
-      "hashed_token",
-      "actor_id",
-      "token_scopes",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
@@ -6344,19 +9661,30 @@
     "description": "An OAuth access token was regenerated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "_document_id",
-      "created_at",
       "@timestamp",
-      "operation_type",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ]
   },
@@ -6365,16 +9693,28 @@
     "description": "An OAuth access token was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "request_access_security_header",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
       "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6384,18 +9724,30 @@
     "description": "An OAuth access token was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6403,42 +9755,66 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "org",
-      "created_at",
-      "oauth_application_id",
-      "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
       "@timestamp",
       "_document_id",
-      "request_id",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
-  },
-  {
-    "action": "oauth_application.destroy",
-    "description": "An OAuth application was deleted.",
-    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
-    "fields": [
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user_id",
       "operation_type",
+      "oauth_application"
+    ],
+    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+  },
+  {
+    "action": "oauth_application.destroy",
+    "description": "An OAuth application was deleted.",
+    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+    "fields": [
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6447,20 +9823,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6469,20 +9857,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6491,19 +9891,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6512,20 +9925,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6534,20 +9959,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6557,18 +9994,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "org_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "oauth_application_id",
-      "action",
       "created_at",
-      "actor",
-      "actor_id",
-      "oauth_application",
-      "_document_id",
-      "request_id"
+      "oauth_application"
     ]
   },
   {
@@ -6576,19 +10026,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6597,15 +10060,32 @@
     "description": "An OAuth application was unsuspended for a user or organization account.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "operation_type",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "oauth_application_id",
-      "oauth_application",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "_document_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "oauth_application_id",
+      "oauth_application",
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6614,24 +10094,31 @@
     "description": "An authorization for an OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "user_id",
-      "actor",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
       "actor_id",
-      "user",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "actor_is_bot",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -6641,20 +10128,31 @@
     "description": "An authorization for an OAuth application was deleted.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "actor",
       "created_at",
       "explanation",
-      "user",
-      "user_id",
-      "org_id",
-      "action",
-      "actor_id",
-      "token_scopes",
       "actor_is_bot",
       "oauth_application_name"
     ],
@@ -6665,20 +10163,31 @@
     "description": "An authorization for an OAuth application was updated.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
-      "actor_id",
       "user_agent",
-      "@timestamp",
       "operation_type",
-      "action",
-      "user",
       "created_at",
-      "_document_id",
       "actor_is_bot",
-      "request_access_security_header",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -6688,17 +10197,28 @@
     "description": "An invitation sent to an organization to join an enterprise was accepted.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6709,20 +10229,30 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
   },
@@ -6731,21 +10261,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -6754,24 +10294,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6779,21 +10329,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -6801,43 +10361,61 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes"
-    ]
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "org.advanced_security_disabled_on_all_repos",
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6845,20 +10423,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6866,22 +10454,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6889,21 +10485,31 @@
     "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "new_policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -6913,19 +10519,30 @@
     "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -6934,19 +10551,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -6956,16 +10584,29 @@
     "description": "A user initiated a background job to delete an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ]
   },
@@ -6974,16 +10615,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -6992,18 +10646,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
-      "actor",
-      "user_agent",
-      "org_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "blocked_user",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -7012,19 +10679,30 @@
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -7034,22 +10712,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "email",
-      "@timestamp",
-      "actor",
-      "action",
       "operation_type",
-      "user_agent",
-      "org",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -7057,19 +10746,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -7077,23 +10777,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7101,21 +10809,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7123,23 +10841,31 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7147,23 +10873,31 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7171,21 +10905,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -7194,21 +10937,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -7217,36 +10969,62 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at"
-    ],
-    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
-  },
-  {
-    "action": "org.config.disable_contributors_only",
-    "description": "The interaction limit for prior contributors only for an organization was disabled.",
-    "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
-    "fields": [
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
+  },
+  {
+    "action": "org.config.disable_contributors_only",
+    "description": "The interaction limit for prior contributors only for an organization was disabled.",
+    "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
+    "fields": [
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -7255,17 +11033,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -7275,16 +11066,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -7293,17 +11097,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -7312,17 +11129,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -7331,22 +11161,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -7355,17 +11193,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -7376,18 +11225,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
-      "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -7396,18 +11257,30 @@
     "description": "An organization was deleted by a user or staff.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "org_id",
-      "org",
       "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7415,20 +11288,30 @@
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -7437,19 +11320,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -7458,14 +11352,31 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sso_url",
       "issuer",
-      "action",
-      "@timestamp",
-      "_document_id",
       "created_at",
-      "org",
       "operation_type"
     ]
   },
@@ -7474,17 +11385,30 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7492,19 +11416,30 @@
     "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7512,19 +11447,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
-      "action",
-      "actor_id",
-      "org_id"
+      "created_at"
     ]
   },
   {
@@ -7532,19 +11478,30 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -7553,19 +11510,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -7574,19 +11542,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "sso_url",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "issuer",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "sso_url",
+      "created_at",
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -7595,17 +11576,30 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
   },
@@ -7614,17 +11608,30 @@
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -7633,18 +11640,31 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
-      "org",
-      "user_agent",
-      "request_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "manager",
       "operation_type",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7652,23 +11672,32 @@
     "description": "A new user was invited to join an organization.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
     "fields": [
-      "org",
-      "user_id",
-      "invitation_id",
-      "org_id",
-      "user",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -7677,17 +11706,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7697,19 +11737,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7717,19 +11768,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7738,16 +11800,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7755,17 +11830,30 @@
     "description": "An organization was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7773,19 +11861,31 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -7794,42 +11894,62 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at"
-    ],
-    "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
-  },
-  {
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
+  },
+  {
     "action": "org.remove_member",
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7837,21 +11957,30 @@
     "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user",
-      "org_id",
-      "created_at",
-      "request_id",
       "@timestamp",
-      "action",
-      "operation_type",
-      "user_agent",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7859,21 +11988,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -7881,18 +12020,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -7901,19 +12052,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
-      "old_login",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_login",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7921,20 +12084,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -7943,21 +12116,33 @@
     "description": "A self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -7967,21 +12152,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7990,48 +12185,66 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
-      "runner_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
-  },
-  {
-    "action": "org.runner_group_runners_added",
-    "description": "A self-hosted runner was added to a group.",
-    "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
-    "fields": [
-      "user_agent",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "runner_group_id",
-      "org",
-      "org_id",
-      "action",
+      "runner_id",
       "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
+  },
+  {
+    "action": "org.runner_group_runners_added",
+    "description": "A self-hosted runner was added to a group.",
+    "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
+    "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -8040,19 +12253,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -8061,25 +12287,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -8088,21 +12325,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -8112,21 +12358,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -8136,20 +12391,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -8158,22 +12423,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -8182,21 +12455,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -8205,21 +12487,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -8228,22 +12519,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -8252,21 +12551,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -8275,21 +12583,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -8299,21 +12616,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -8323,19 +12649,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -8345,21 +12682,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -8369,21 +12715,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -8393,19 +12748,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -8415,22 +12781,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8439,22 +12813,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8463,22 +12845,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8487,21 +12877,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8510,21 +12909,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8533,22 +12941,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8557,22 +12973,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8581,12 +13005,28 @@
     "description": "The push protection setting was updated for a secret type for your organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "push_protection_setting",
       "secret_type",
       "secret_type_display_name",
@@ -8599,12 +13039,28 @@
     "description": "The push protection pattern configuration was updated for your organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at"
     ],
     "docs_reference_titles": "About push protection"
@@ -8614,26 +13070,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8642,26 +13107,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8669,28 +13142,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8698,26 +13179,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8725,15 +13214,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -8742,15 +13248,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -8759,7 +13282,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -8774,18 +13318,28 @@
     "description": "The cache retention policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8797,18 +13351,28 @@
     "description": "The cache storage policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8820,20 +13384,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -8842,16 +13417,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -8862,18 +13450,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -8882,17 +13483,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8900,18 +13514,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -8920,18 +13546,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -8940,18 +13579,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -8960,22 +13611,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issuer",
-      "business",
       "operation_type",
       "created_at",
-      "request_id",
-      "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8983,19 +13644,31 @@
     "description": "A user account was converted into an organization.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization",
     "fields": [
-      "actor",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "@timestamp",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "owner",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "owner"
     ],
     "docs_reference_titles": "Converting a user into an organization"
   },
@@ -9004,19 +13677,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
-      "oauth_application_id",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "blocked_user",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -9025,23 +13711,34 @@
     "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -9050,20 +13747,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -9072,20 +13781,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -9093,17 +13813,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -9113,20 +13846,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -9135,19 +13879,32 @@
     "description": "An organization's SAML provider settings were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "issuer",
-      "org",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -9155,18 +13912,30 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "org",
-      "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
@@ -9175,11 +13944,28 @@
     "description": "A new organization custom property definition was created.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "description",
@@ -9187,11 +13973,6 @@
       "required",
       "allowed_values",
       "default_value",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9203,11 +13984,28 @@
     "description": "An organization custom property definition was deleted.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "description",
@@ -9215,11 +14013,6 @@
       "required",
       "allowed_values",
       "default_value",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9231,20 +14024,32 @@
     "description": "An organization custom property definition was updated.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "old_values_editable_by",
       "values_editable_by",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -9259,21 +14064,31 @@
     "description": "An organization's custom property value was manually set for the first time.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9285,21 +14100,31 @@
     "description": "An organization's custom property value was deleted.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9311,20 +14136,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner_type",
-      "domain_name",
-      "org_id",
+      "business",
       "business_id",
-      "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "domain_name",
+      "owner",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -9333,16 +14171,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -9351,14 +14204,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -9369,16 +14237,31 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "operation_type",
-      "domain_name",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
       "_document_id",
-      "actor_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "domain_name",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -9387,20 +14270,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -9410,23 +14304,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -9435,21 +14340,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -9460,21 +14376,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -9483,20 +14412,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -9505,17 +14448,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9526,20 +14484,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -9548,19 +14520,31 @@
     "description": "A new passkey was added.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9568,19 +14552,31 @@
     "description": "A new passkey was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9588,18 +14584,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9607,16 +14615,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9624,18 +14646,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9643,18 +14677,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9665,22 +14712,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9688,22 +14744,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9711,18 +14776,28 @@
     "description": "The configured restriction for access to resources via personal access tokens was reset and delegated to organizations.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9733,18 +14808,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9755,18 +14843,28 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9777,18 +14875,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9799,18 +14907,28 @@
     "description": "Triggered when the enterprise delegates to the organizations when to require approval for fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9821,17 +14939,30 @@
     "description": "Triggered when you create a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9841,19 +14972,31 @@
     "description": "Triggered when you regenerate a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9861,12 +15004,29 @@
     "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
     "fields": [
-      "user_programmatic_access_name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
       "operation_type"
     ],
@@ -9877,20 +15037,32 @@
     "description": "Triggered when you delete a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "explanation",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9898,23 +15070,34 @@
     "description": "A personal access token expiration limit was set.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "token_expiration",
       "old_token_expiration",
       "exempt_administrators",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9922,39 +15105,63 @@
     "description": "A personal access token expiration limit was unset.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "programmatic_access_type",
-      "old_token_expiration",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "personal_access_token.request_cancelled",
-    "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "user_programmatic_access_name",
+      "hashed_token",
       "org",
       "org_id",
-      "repository_selection",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_token_expiration",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
+    ]
+  },
+  {
+    "action": "personal_access_token.request_cancelled",
+    "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
+      "repository_selection",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9965,18 +15172,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9988,17 +15208,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -10010,17 +15243,30 @@
     "description": "A fine-grained personal access token was updated.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -10031,15 +15277,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -10049,17 +15310,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -10069,15 +15341,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -10087,17 +15374,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -10107,17 +15405,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -10127,17 +15436,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -10147,17 +15467,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -10167,17 +15498,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -10187,17 +15531,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10205,20 +15562,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -10228,25 +15596,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -10254,20 +15634,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10275,25 +15667,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10301,17 +15705,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10319,17 +15736,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10337,18 +15767,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -10357,18 +15799,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -10377,19 +15831,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -10397,17 +15862,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -10419,22 +15897,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -10442,19 +15929,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10462,17 +15960,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10480,18 +15991,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -10499,20 +16023,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10520,38 +16054,62 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
   {
     "action": "project_view.delete",
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -10560,16 +16118,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -10581,21 +16152,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -10603,22 +16186,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -10627,29 +16220,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10657,24 +16255,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "repo_id",
-      "user_id",
       "@timestamp",
-      "user_agent",
-      "repo",
-      "name",
-      "org_id",
-      "user",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -10685,21 +16291,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -10710,22 +16326,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10733,24 +16359,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "oauth_application_id",
-      "authorized_actors_only",
-      "authorized_actors",
-      "created_at",
-      "user_agent",
-      "name",
-      "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "authorized_actors_only",
+      "authorized_actors",
+      "created_at",
+      "name",
+      "operation_type"
     ]
   },
   {
@@ -10758,30 +16394,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -10791,28 +16434,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -10823,23 +16474,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -10847,22 +16507,32 @@
     "description": "Branch deletion was enabled or disabled for a protected branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "operation_type",
-      "request_id",
-      "repo",
       "@timestamp",
-      "org_id",
-      "org",
-      "action",
-      "allow_deletions_enforcement_level",
       "_document_id",
-      "created_at",
-      "actor_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_deletions_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10870,23 +16540,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "actor_id",
-      "name",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo",
-      "operation_type",
-      "request_id",
-      "allow_force_pushes_enforcement_level",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_force_pushes_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10894,24 +16573,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -10920,22 +16608,32 @@
     "description": "Required linear commit history was enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "operation_type",
       "actor",
-      "linear_history_requirement_enforcement_level",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "linear_history_requirement_enforcement_level",
       "name",
-      "org_id",
-      "repo_id",
-      "org",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -10943,24 +16641,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "lock_allows_fetch_and_merge",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10969,27 +16676,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10998,18 +16712,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11020,24 +16747,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11045,25 +16781,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -11071,22 +16814,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -11094,22 +16847,33 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
   },
@@ -11118,22 +16882,32 @@
     "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "required_approving_review_count",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -11141,25 +16915,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
     ]
   },
   {
@@ -11167,22 +16948,32 @@
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
       "action",
       "actor",
       "actor_id",
-      "signature_requirement_enforcement_level",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "programmatic_access_type"
+      "operation_type",
+      "name",
+      "created_at",
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -11190,22 +16981,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "created_at",
-      "repo_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "name",
-      "actor",
-      "repo",
       "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
+      "strict_required_status_checks_policy"
     ]
   },
   {
@@ -11213,23 +17014,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -11238,24 +17050,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -11264,20 +17087,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -11286,21 +17123,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -11310,22 +17160,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -11334,25 +17196,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -11361,23 +17233,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
-      "created_at",
-      "key",
-      "fingerprint",
-      "actor_id",
       "actor",
-      "title",
-      "user_agent",
-      "user_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "read_only",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "key",
+      "fingerprint",
+      "title",
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -11386,18 +17269,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -11407,21 +17304,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -11430,19 +17338,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -11453,23 +17374,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -11479,17 +17412,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11497,19 +17444,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -11517,19 +17477,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -11539,21 +17512,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -11562,27 +17546,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
-      "pull_request_url",
-      "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
+      "pull_request_url",
+      "pull_request_title",
+      "public_repo",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -11590,23 +17581,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -11615,18 +17618,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -11634,19 +17651,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -11656,20 +17685,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
-      "repo",
-      "created_at",
-      "request_id",
-      "comment_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "comment_id",
+      "operation_type"
     ]
   },
   {
@@ -11677,18 +17717,31 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "_document_id",
-      "@timestamp",
-      "comment_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "comment_id"
     ]
   },
   {
@@ -11696,21 +17749,33 @@
     "description": "A review on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -11718,20 +17783,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -11740,19 +17818,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -11762,22 +17854,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "created_at",
-      "user_agent",
-      "actor",
+      "_document_id",
       "action",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -11786,21 +17888,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -11809,25 +17920,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -11836,23 +17954,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -11861,24 +17987,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -11887,23 +18020,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -11913,22 +18054,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -11937,19 +18087,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11958,24 +18121,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -11984,24 +18157,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -12009,24 +18190,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -12034,24 +18223,32 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -12059,24 +18256,32 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -12084,23 +18289,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -12111,17 +18325,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -12131,17 +18357,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -12151,25 +18389,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -12178,26 +18422,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -12206,25 +18458,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "query_suite",
-      "threat_model",
-      "languages",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "query_suite",
+      "threat_model",
+      "languages",
+      "public_repo",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -12234,20 +18495,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "visibility",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -12255,17 +18527,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -12274,15 +18559,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -12293,16 +18591,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -12312,17 +18623,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -12332,19 +18656,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -12353,17 +18688,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -12372,26 +18720,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -12400,31 +18754,36 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
-      "repo",
-      "user_id",
-      "visibility",
-      "repo_id",
-      "user",
-      "request_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_category",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "org",
-      "oauth_application_id",
-      "org_id",
-      "request_method",
+      "actor_id",
       "business",
       "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "request_category",
+      "created_at",
+      "oauth_application_id",
+      "request_method",
+      "public_repo",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
   },
@@ -12433,20 +18792,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12455,25 +18825,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12482,23 +18860,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12506,25 +18895,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -12534,17 +18932,30 @@
     "description": "A repository was archived on disk.",
     "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
-      "repo_id",
-      "actor",
       "action",
-      "user_agent"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository/archiving-repositories"
   },
@@ -12553,23 +18964,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -12579,62 +18999,95 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "visibility",
-      "repo_id",
-      "created_at",
-      "actor",
-      "action",
-      "@timestamp",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id"
-    ]
-  },
-  {
-    "action": "repo.noindex",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "visibility",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "actor_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "actor",
-      "user_agent",
-      "repo",
       "user_id",
-      "public_repo"
+      "user_agent",
+      "operation_type",
+      "visibility",
+      "created_at"
     ]
   },
   {
-    "action": "repo.override_unlock",
-    "description": "The repository was unlocked.",
+    "action": "repo.noindex",
+    "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
       "operation_type",
+      "public_repo"
+    ]
+  },
+  {
+    "action": "repo.override_unlock",
+    "description": "The repository was unlocked.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "created_at",
-      "_document_id"
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12642,20 +19095,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "action",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "operation_type",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "visibility",
-      "actor",
-      "user_id"
+      "visibility"
     ]
   },
   {
@@ -12663,23 +19127,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -12687,21 +19161,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12709,21 +19193,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -12731,22 +19225,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -12754,21 +19257,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -12776,20 +19289,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -12797,22 +19321,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12820,18 +19353,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -12839,22 +19386,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -12862,21 +19419,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12884,18 +19451,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -12904,22 +19483,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12928,24 +19516,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12954,23 +19550,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12978,26 +19584,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -13006,21 +19617,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -13029,25 +19649,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -13055,22 +19681,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -13079,20 +19715,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "visibility",
-      "operation_type",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "@timestamp",
-      "request_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -13100,19 +19747,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13120,17 +19778,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -13139,17 +19812,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -13158,7 +19846,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -13173,22 +19882,30 @@
     "description": "The cache retention policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -13200,22 +19917,30 @@
     "description": "The cache storage policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -13227,23 +19952,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -13253,20 +19987,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -13277,21 +20022,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -13300,22 +20056,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -13324,21 +20090,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -13347,22 +20124,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -13373,16 +20160,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -13391,22 +20189,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -13416,22 +20223,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "owner",
-      "user",
-      "old_user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
+      "old_user",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -13440,23 +20258,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -13466,19 +20294,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -13486,21 +20324,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -13509,24 +20357,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13534,25 +20391,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -13561,24 +20425,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13587,25 +20461,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -13614,22 +20496,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13638,26 +20529,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -13665,31 +20564,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13698,24 +20604,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -13724,24 +20636,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -13750,25 +20668,31 @@
     "description": "Code security was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13777,25 +20701,31 @@
     "description": "Code security was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13804,21 +20734,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -13826,21 +20766,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13848,21 +20798,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -13870,20 +20831,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -13891,21 +20864,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13913,19 +20897,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -13933,31 +20930,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -13966,19 +20971,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -13986,8 +21002,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -13996,23 +21011,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -14037,26 +21061,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -14065,26 +21095,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -14093,49 +21129,63 @@
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "public_repo"
-    ],
-    "docs_reference_titles": "Defining custom patterns for secret scanning"
-  },
-  {
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "public_repo"
+    ],
+    "docs_reference_titles": "Defining custom patterns for secret scanning"
+  },
+  {
     "action": "repository_secret_scanning_custom_pattern.delete",
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14145,24 +21195,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14172,24 +21229,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -14198,24 +21262,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14225,23 +21296,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14251,23 +21329,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14276,22 +21362,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14299,24 +21393,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -14325,24 +21427,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -14351,19 +21461,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14372,24 +21494,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14398,24 +21528,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14424,19 +21562,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14445,26 +21595,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14473,26 +21628,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14501,28 +21661,36 @@
     "description": "A code security configuration was applied to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14530,27 +21698,35 @@
     "description": "A code security configuration failed to attach to the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14558,28 +21734,36 @@
     "description": "A code security configuration was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14587,28 +21771,36 @@
     "description": "A code security configuration was removed due to a change in repository or enterprise settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14616,29 +21808,37 @@
     "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -14647,29 +21847,37 @@
     "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -14678,19 +21886,32 @@
     "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
-      "operation_type",
-      "request_id",
-      "repo_id",
       "@timestamp",
-      "user_agent",
-      "alert_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "alert_id",
+      "created_at",
+      "alert_number"
     ],
     "docs_reference_titles": "About Dependabot alerts"
   },
@@ -14699,23 +21920,32 @@
     "description": "A Dependabot alert was manually dismissed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "alert_id",
-      "actor",
-      "repo",
       "created_at",
-      "org",
-      "_document_id",
-      "action",
-      "actor_id",
       "dismiss_reason",
-      "user",
       "dismiss_comment",
       "alert_number",
       "actor_is_bot"
@@ -14726,21 +21956,33 @@
     "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "public_repo",
       "owner",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "token_scopes",
       "alert_number"
     ]
   },
@@ -14749,26 +21991,34 @@
     "description": "A Dependabot alert was manually reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo",
-      "alert_number",
-      "request_access_security_header"
+      "alert_number"
     ]
   },
   {
@@ -14776,21 +22026,32 @@
     "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "alert_id",
-      "repo",
-      "operation_type",
-      "action",
-      "repo_id",
-      "_document_id",
-      "user_agent",
-      "request_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "operation_type",
+      "created_at",
+      "alert_number"
     ]
   },
   {
@@ -14798,21 +22059,35 @@
     "description": "A Dependabot alert was withdrawn.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
       "created_at",
       "active",
-      "action",
-      "repository_id",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type"
     ]
   },
@@ -14821,20 +22096,30 @@
     "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
     "fields": [
-      "org",
+      "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
-      "operation_type",
-      "created_at",
-      "actor",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
   },
@@ -14843,24 +22128,31 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -14868,26 +22160,32 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14895,23 +22193,30 @@
     "description": "Dependabot alerts was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "request_id",
-      "repo_id",
-      "action",
-      "actor_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "_document_id",
       "user_id",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14919,23 +22224,30 @@
     "description": "Dependabot alerts was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_agent",
-      "created_at",
       "@timestamp",
-      "repo_id",
+      "_document_id",
       "action",
-      "user",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor_id",
-      "_document_id",
-      "user_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -14944,18 +22256,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -14964,19 +22289,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -14985,14 +22322,28 @@
     "description": "A user was assigned to a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15007,14 +22358,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15028,22 +22393,32 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
@@ -15052,28 +22427,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -15081,25 +22465,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -15107,14 +22498,28 @@
     "description": "A user was unassigned from a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15129,14 +22534,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -15153,19 +22572,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15174,62 +22604,94 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
-    ],
-    "docs_reference_titles": "About secret scanning"
-  },
-  {
-    "action": "secret_scanning_new_repos.disable",
-    "description": "Secret scanning was disabled for all new repositories.",
-    "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
-    "fields": [
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
   {
-    "action": "secret_scanning_new_repos.enable",
-    "description": "Secret scanning was enabled for all new repositories.",
+    "action": "secret_scanning_new_repos.disable",
+    "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "About secret scanning"
+  },
+  {
+    "action": "secret_scanning_new_repos.enable",
+    "description": "Secret scanning was enabled for all new repositories.",
+    "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
+    "fields": [
       "@timestamp",
-      "_document_id"
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15238,14 +22700,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -15263,25 +22739,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -15290,25 +22774,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -15318,25 +22810,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -15345,22 +22845,35 @@
     "description": "A secret scanning scan has completed on this repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "repo_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "source",
       "type",
       "source_slug",
       "type_slug",
       "started_at",
       "completed_at",
-      "repo",
       "public_repo",
-      "org",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "secret_types",
@@ -15374,10 +22887,28 @@
     "description": "A security configuration was created",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15392,15 +22923,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15418,22 +22942,33 @@
     "description": "A default security configuration setting for new repositories was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15442,22 +22977,33 @@
     "description": "A default security configuration setting for new repositories was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "default_for_new_private_repos",
-      "default_for_new_public_repos",
-      "security_configuration_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "default_for_new_private_repos",
+      "default_for_new_public_repos",
+      "security_configuration_name",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15466,10 +23012,28 @@
     "description": "A security configuration was deleted",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15484,15 +23048,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15509,15 +23066,30 @@
     "description": "A security configuration policy was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enforcement",
       "security_configuration_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15527,10 +23099,28 @@
     "description": "A security configuration was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15545,15 +23135,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15571,18 +23154,30 @@
     "description": "A security key was registered for an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15590,18 +23185,30 @@
     "description": "A security key was removed from an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15609,14 +23216,28 @@
     "description": "A user linked a social identity to their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -15626,14 +23247,28 @@
     "description": "A user unlinked a social identity from their account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -15643,15 +23278,28 @@
     "description": "A user unlinked all social identities from their account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -15661,16 +23309,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15680,18 +23341,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -15700,16 +23374,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15720,15 +23407,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -15738,15 +23438,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -15755,17 +23470,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -15774,17 +23502,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -15793,16 +23535,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -15812,14 +23567,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -15829,17 +23599,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -15848,17 +23631,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -15867,18 +23663,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "sponsors_listing_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sponsors_listing_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15887,15 +23696,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -15905,16 +23728,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15922,15 +23758,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -15941,16 +23790,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -15960,17 +23822,30 @@
     "description": "Triggered when you send an email update to your sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
     "fields": [
-      "request_id",
-      "actor",
-      "action",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
   },
@@ -15979,17 +23854,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -16000,17 +23888,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -16021,18 +23922,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16042,16 +23954,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16061,17 +23986,30 @@
     "description": "You join the waitlist to join GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
-      "user_agent",
       "actor_id",
-      "action",
-      "operation_type",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -16080,16 +24018,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16101,17 +24052,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16120,19 +24084,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16141,21 +24118,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "user",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
       "action",
-      "user_id",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "actor_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16164,19 +24150,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16185,20 +24182,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16206,18 +24217,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -16225,16 +24251,31 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "domain_name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16242,47 +24283,67 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
-    ]
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
+      "public_repo",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
+    ]
   },
   {
     "action": "sub_issues.parent_issue_remove",
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16290,23 +24351,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16314,23 +24385,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16338,15 +24419,30 @@
     "description": "Triggered when you accept a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -16355,15 +24451,30 @@
     "description": "Triggered when you cancel a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -16372,15 +24483,30 @@
     "description": "Triggered when you create a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -16389,15 +24515,30 @@
     "description": "Triggered when you decline a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -16406,15 +24547,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16422,38 +24578,63 @@
     "description": "Triggered when you revoke a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
-  },
-  {
-    "action": "team.add_member",
-    "description": "A member of an organization was added to a team.",
-    "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "actor_id",
-      "created_at",
+      "user_id",
+      "user_agent",
       "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
+  },
+  {
+    "action": "team.add_member",
+    "description": "A member of an organization was added to a team.",
+    "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
+    "fields": [
+      "@timestamp",
       "_document_id",
-      "org",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -16463,22 +24644,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -16487,20 +24677,30 @@
     "description": "A team was added to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team_type",
       "team",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -16511,20 +24711,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -16533,18 +24744,31 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
       "created_at",
       "operation_type",
-      "actor_id",
-      "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
@@ -16554,21 +24778,32 @@
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -16577,21 +24812,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -16600,19 +24845,31 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "team",
       "org_id",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
       "operation_type",
-      "_document_id",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -16621,19 +24878,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
       "business",
-      "action",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16641,19 +24909,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "request_id",
       "actor",
-      "org",
-      "created_at",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16661,18 +24940,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
       "@timestamp",
-      "action",
       "_document_id",
-      "user_agent",
-      "user_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -16681,22 +24971,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -16705,20 +25004,30 @@
     "description": "A team was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team_type",
       "team",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -16729,22 +25038,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -16754,21 +25072,31 @@
     "description": "A repository was removed from a team's control.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "org",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -16776,21 +25104,32 @@
     "description": "A team's name was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "user_agent",
-      "created_at",
-      "team",
-      "operation_type",
-      "actor_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -16799,17 +25138,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -16818,49 +25170,69 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id"
-    ],
-    "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
   {
     "action": "team.update_repository_permission",
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
       "operation_type",
       "created_at",
-      "user_agent",
       "permission",
       "new_repo_permission",
       "new_repo_base_role",
       "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_repo_base_role"
     ]
   },
   {
@@ -16868,17 +25240,30 @@
     "description": "A new trusted device was added.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16886,17 +25271,30 @@
     "description": "A trusted device was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16904,14 +25302,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "action",
-      "request_id",
-      "user_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -16920,15 +25333,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "created_at",
-      "user_id",
-      "operation_type",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16936,13 +25364,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "created_at",
-      "user_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16950,17 +25395,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "operation_type",
-      "action",
-      "_document_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16968,17 +25426,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16986,16 +25457,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17003,34 +25488,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "user",
       "_document_id",
-      "request_id"
-    ]
-  },
-  {
-    "action": "two_factor_authentication.add_factor",
-    "description": "A secondary authentication factor was added to a user account.",
-    "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
-    "fields": [
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "two_factor_authentication.add_factor",
+    "description": "A secondary authentication factor was added to a user account.",
+    "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -17039,18 +25551,30 @@
     "description": "Two-factor authentication was disabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
     "fields": [
-      "actor",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_id",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Disabling two-factor authentication for your personal account"
   },
@@ -17059,18 +25583,30 @@
     "description": "Two-factor authentication was enabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
-      "actor",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Configuring two-factor authentication"
   },
@@ -17079,15 +25615,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user",
-      "user_id",
-      "action",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "user_agent"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17095,16 +25646,29 @@
     "description": "Two factor recovery codes were regenerated for a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
+      "operation_type",
       "created_at"
     ]
   },
@@ -17113,18 +25677,30 @@
     "description": "A secondary authentication factor was removed from a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -17133,15 +25709,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "created_at",
-      "_document_id",
-      "action",
-      "@timestamp"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17150,16 +25741,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "operation_type",
       "user_agent",
-      "action",
-      "request_id",
-      "actor",
-      "actor_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17167,19 +25771,31 @@
     "description": "An email address was added to a user account.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "actor_id",
-      "actor",
       "email",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding an email address to your GitHub account"
   },
@@ -17188,18 +25804,30 @@
     "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "created_at",
-      "user",
       "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
       "action",
-      "request_access_security_header"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17207,15 +25835,28 @@
     "description": "Audit log entries were exported.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "action",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ]
@@ -17225,20 +25866,31 @@
     "description": "A user was blocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_id",
-      "_document_id",
       "actor_id",
-      "@timestamp",
-      "user_agent",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -17246,18 +25898,30 @@
     "description": "A user changed their password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "actor_id",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17265,18 +25929,30 @@
     "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -17285,17 +25961,30 @@
     "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -17304,23 +25993,38 @@
     "description": "Triggered when a user content edit is deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_content_id",
       "user_content_type",
       "created_at",
-      "user_agent",
       "deleted_by",
       "editor_id",
-      "_document_id",
       "deleted_at",
-      "action",
-      "actor_id",
       "editor",
       "deleted_by_id",
       "deleted_content",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -17328,16 +26032,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
-      "user",
       "action",
-      "operation_type",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17345,16 +26063,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "_document_id",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17362,58 +26094,96 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user_id",
-      "@timestamp",
-      "user",
-      "action",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "user.create",
-    "description": "A new user account was created.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "email",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "created_at",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "programmatic_access_type"
-    ]
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "user.create",
+    "description": "A new user account was created.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "email",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "user.create_integration_secret",
     "description": "A user secret for Codespaces was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17421,20 +26191,31 @@
     "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "oauth_application_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "@timestamp",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -17442,18 +26223,30 @@
     "description": "A user account was destroyed by an asynchronous job.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17462,19 +26255,30 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "oauth_application_id",
+      "_document_id",
       "action",
-      "user",
-      "created_at",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17482,18 +26286,30 @@
     "description": "A user deleted his or her account, triggering user.async_delete.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
-      "created_at",
-      "user_agent",
       "user_id",
-      "operation_type",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17501,18 +26317,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "user_agent",
       "user_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17520,18 +26348,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "_document_id",
-      "@timestamp",
-      "user",
-      "actor_id",
-      "action",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -17540,35 +26380,60 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "request_id",
       "actor",
       "actor_id",
-      "user_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "user.disable_collaborators_only",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "user.disable_collaborators_only",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -17576,17 +26441,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -17594,17 +26472,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -17612,21 +26503,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -17634,21 +26535,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -17657,17 +26568,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -17675,17 +26599,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -17693,17 +26630,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -17711,18 +26661,30 @@
     "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "org_id",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17730,35 +26692,62 @@
     "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "user_id",
-      "action",
       "_document_id",
-      "user_agent",
-      "created_at"
-    ]
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "user.forgot_password",
     "description": "A user requested a password reset.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
     "fields": [
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "email",
-      "created_at",
-      "user_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
   },
@@ -17767,17 +26756,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "created_at",
-      "user_agent",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "request_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17785,18 +26787,30 @@
     "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -17805,19 +26819,31 @@
     "description": "A user signed in.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "actor_id",
       "@timestamp",
-      "user",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "actor",
-      "passkey_nickname",
-      "request_access_security_header"
+      "passkey_nickname"
     ]
   },
   {
@@ -17825,18 +26851,30 @@
     "description": "A user signed out.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17844,19 +26882,30 @@
     "description": "A comment made by a user was minimized.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
-      "actor_id",
       "@timestamp",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "user",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17864,18 +26913,30 @@
     "description": "A user signed in from a new device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17883,14 +26944,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17898,21 +26975,31 @@
     "description": "An ordinary user account was promoted to a site administrator.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
+      "user_id",
       "user_agent",
+      "created_at",
       "oauth_application_id",
-      "request_id",
-      "operation_type",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17920,16 +27007,29 @@
     "description": "A user's account was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user",
-      "action",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "operation_type"
     ]
   },
@@ -17938,20 +27038,31 @@
     "description": "An email address was removed from a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "actor_id",
       "created_at",
-      "email",
-      "token_scopes",
-      "programmatic_access_type"
+      "email"
     ]
   },
   {
@@ -17959,20 +27070,32 @@
     "description": "A user secret for Codespaces was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "key",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17980,17 +27103,30 @@
     "description": "A user account was no longer flagged as a large scale contributor.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -17998,20 +27134,31 @@
     "description": "A username was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "request_id",
-      "actor_id",
-      "old_login",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_login",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -18019,17 +27166,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "user_agent",
-      "request_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -18038,18 +27197,30 @@
     "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "action",
       "created_at",
-      "actor",
-      "operation_type",
-      "actor_id",
-      "user_id",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam"
   },
@@ -18058,18 +27229,30 @@
     "description": "A user reset their account password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -18077,16 +27260,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -18097,16 +27293,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -18115,18 +27323,30 @@
     "description": "A user signed in from an unrecognized device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user",
-      "user_id",
-      "operation_type",
-      "created_at",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18134,18 +27354,30 @@
     "description": "A user signed in from an unrecognized device and location.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "created_at",
-      "_document_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -18153,18 +27385,30 @@
     "description": "A user signed in from an unrecognized location.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "action",
-      "operation_type",
-      "user_agent",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
       "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18172,22 +27416,33 @@
     "description": "Triggered when you clear the status on your profile.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "message",
-      "user",
-      "actor_id",
       "created_at",
-      "request_id",
       "limited_availability",
-      "action",
       "emoji",
-      "operation_type",
-      "user_agent",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -18195,23 +27450,33 @@
     "description": "Triggered when you set or change the status on your profile.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
     "fields": [
-      "limited_availability",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "message",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "limited_availability",
+      "message",
+      "created_at",
       "emoji",
-      "org",
-      "actor",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
   },
@@ -18220,21 +27485,31 @@
     "description": "A user account was suspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "user_agent",
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "token_scopes",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18242,18 +27517,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
-      "actor_id",
       "@timestamp",
-      "operation_type",
       "_document_id",
-      "user_agent",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18261,18 +27548,30 @@
     "description": "A 2FA challenge issued for a user account failed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "actor_id",
-      "actor",
-      "user_id",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18282,16 +27581,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
       "user_agent",
-      "request_id",
-      "action",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18299,18 +27610,30 @@
     "description": "A user used their 2FA recovery codes.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18318,18 +27641,30 @@
     "description": "A user downloaded 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18337,17 +27672,30 @@
     "description": "A user printed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18355,18 +27703,30 @@
     "description": "A user viewed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_agent",
-      "actor",
-      "user_id",
-      "action",
-      "created_at",
-      "user",
-      "operation_type",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "request_access_security_header"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -18374,17 +27734,30 @@
     "description": "A user was prompted for a two-factor authentication code.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
     "fields": [
-      "user",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "actor"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
   },
@@ -18393,19 +27766,31 @@
     "description": "A user was unblocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "user_agent",
-      "user_id",
-      "user",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -18414,15 +27799,28 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user_agent",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "request_id",
-      "actor",
-      "action",
       "created_at"
     ]
   },
@@ -18431,21 +27829,31 @@
     "description": "A user account was unsuspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "user_agent",
       "actor",
-      "oauth_application_id",
-      "operation_type",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "user_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18453,21 +27861,33 @@
     "description": "A user secret for Codespaces was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -18475,18 +27895,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -18494,16 +27926,30 @@
     "description": "A Dependabot rule was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -18513,16 +27959,30 @@
     "description": "A Dependabot rule was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -18532,18 +27992,31 @@
     "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -18553,21 +28026,33 @@
     "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -18575,21 +28060,32 @@
     "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -18597,21 +28093,32 @@
     "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -18619,16 +28126,30 @@
     "description": "A Dependabot rule's conditions, actions, or metadata changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -18638,27 +28159,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -18667,23 +28194,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -18691,10 +28228,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -18705,20 +28260,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -18727,23 +28271,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -18753,10 +28305,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -18768,19 +28338,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -18791,10 +28351,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -18803,21 +28381,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -18827,23 +28394,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -18852,22 +28431,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -18875,21 +28465,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -18897,25 +28498,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -18923,23 +28532,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -18953,24 +28575,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -18979,10 +28610,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -18992,21 +28641,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -19016,25 +28655,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.19/organization.json b/src/audit-logs/data/ghes-3.19/organization.json
index e0d869d05dba..76c4dd8d3706 100644
--- a/src/audit-logs/data/ghes-3.19/organization.json
+++ b/src/audit-logs/data/ghes-3.19/organization.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,29 +67,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -72,21 +103,32 @@
     "description": "Credit was accepted for a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Editing a repository security advisory"
   },
@@ -95,21 +137,32 @@
     "description": "Someone was added to the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -117,21 +170,32 @@
     "description": "Credit was declined for a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -140,21 +204,32 @@
     "description": "Someone was removed from the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -163,18 +238,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -182,17 +269,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -203,43 +301,66 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
+  },
   {
     "action": "billing.budget_create",
     "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -255,22 +376,34 @@
     "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "uuid",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -278,25 +411,37 @@
     "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
-      "request_access_security_header",
       "old_target_amount",
       "old_budget_limit_type",
       "old_alert_enabled",
@@ -310,17 +455,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -329,19 +487,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -350,15 +520,28 @@
     "description": "Azure subscription has been linked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -368,15 +551,28 @@
     "description": "Azure subscription has been unlinked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -386,18 +582,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -405,18 +614,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -424,20 +645,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -446,20 +678,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -470,17 +713,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -488,15 +743,31 @@
     "description": "Existing code scanning alerts appeared in a branch.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -506,15 +777,31 @@
     "description": "Code scanning alerts were fixed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -524,15 +811,31 @@
     "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_numbers",
       "commit_oid",
-      "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business"
+      "ref"
     ],
     "docs_reference_titles": "About code scanning"
   },
@@ -541,15 +844,29 @@
     "description": "Code scanning alerts were manually dismissed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers",
       "dismissal_approver_id"
     ],
@@ -560,19 +877,31 @@
     "description": "Dismissal of code scanning alerts was approved.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -583,19 +912,31 @@
     "description": "Dismissal of code scanning alerts was denied.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -606,19 +947,31 @@
     "description": "Dismissal of code scanning alerts was requested.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -629,13 +982,31 @@
     "description": "Code scanning alerts were seen for the first time.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "commit_oid",
-      "ref",
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
+      "commit_oid",
+      "ref",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -645,15 +1016,31 @@
     "description": "Code scanning alerts that were previously fixed reappeared.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -663,15 +1050,29 @@
     "description": "Code scanning alerts that were previously dismissed were reopened.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -681,14 +1082,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -698,28 +1114,34 @@
     "description": "An attempt to create a codespace from a prebuild was made.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "owner",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "user_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
       "created_at",
       "operation_type",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -727,17 +1149,30 @@
     "description": "Enterprise setting for Codespaces ownership was updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enablement",
       "organization_names",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -748,25 +1183,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -777,22 +1221,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -804,22 +1259,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -828,15 +1294,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "owner",
       "created_at",
       "operation_type",
       "public_repo"
@@ -847,15 +1328,28 @@
     "description": "Policies were applied to codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -865,20 +1359,30 @@
     "description": "Policies were removed from codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -886,19 +1390,30 @@
     "description": "Policies were updated for codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -906,17 +1421,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -926,27 +1454,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "org",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -954,19 +1491,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -974,18 +1524,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -994,20 +1556,30 @@
     "description": "A commit comment was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "created_at",
-      "@timestamp",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "programmatic_access_type"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1015,43 +1587,64 @@
     "description": "A commit comment was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_id",
-      "action",
-      "@timestamp",
-      "repo",
       "org_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "copilot.access_revoked",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "copilot.access_revoked",
     "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "reason",
       "plan",
-      "org_id",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1059,13 +1652,28 @@
     "description": "Copilot feature settings were changed at the organization level.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1075,23 +1683,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1099,16 +1714,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -1117,24 +1746,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1142,15 +1777,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1160,20 +1808,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1181,19 +1839,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -1201,21 +1871,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1223,21 +1902,33 @@
     "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_value",
-      "new_value",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_value",
+      "new_value",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1245,21 +1936,32 @@
     "description": "The excluded paths for GitHub Copilot were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "excluded_paths",
       "owner_type",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1267,14 +1969,28 @@
     "description": "Copilot custom instructions were created for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "custom_instructions"
@@ -1285,14 +2001,28 @@
     "description": "Copilot custom instructions were updated for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "custom_instructions"
@@ -1303,21 +2033,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1325,21 +2065,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1347,21 +2097,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1369,17 +2129,30 @@
     "description": "The plan for GitHub Copilot was updated.",
     "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_plan",
       "plan",
-      "business_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1391,20 +2164,31 @@
     "description": "The plan for GitHub Copilot was scheduled to be downgraded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "current_plan",
       "scheduled_plan"
@@ -1415,18 +2199,30 @@
     "description": "MCP Configuration for Copilot coding agent was updated for a specific repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "new_config",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_config",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1436,22 +2232,33 @@
     "description": "Specific repositories were disabled from using Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "owner_type",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1459,21 +2266,31 @@
     "description": "Specific repositories were enabled to use Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "owner_type",
-      "owner",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1483,20 +2300,32 @@
     "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_access",
       "old_access",
-      "org_id",
       "owner_type",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1506,21 +2335,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1530,19 +2368,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1552,21 +2399,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1576,18 +2432,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1600,18 +2469,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1625,14 +2507,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -1645,8 +2542,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1655,27 +2551,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "definition_id",
-      "property_name",
-      "value",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "definition_id",
+      "property_name",
+      "value",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1684,19 +2588,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1705,16 +2621,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "definition_id"
@@ -1726,19 +2655,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1747,19 +2687,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1768,19 +2719,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1789,19 +2751,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1810,21 +2783,31 @@
     "description": "The default repository access for Dependabot was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "access_level",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -1833,17 +2816,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1851,19 +2847,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1872,19 +2879,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1892,19 +2910,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1913,19 +2942,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1933,19 +2973,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1954,19 +3005,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1974,19 +3036,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1995,20 +3068,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2016,21 +3099,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "repo_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "org_id",
-      "_document_id",
       "actor_id",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2038,43 +3130,62 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "request_id",
-      "org",
       "_document_id",
-      "actor_id",
-      "operation_type",
-      "created_at",
-      "repo",
-      "org_id",
       "action",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "discussion.destroy",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "repo_id",
-      "user_agent",
-      "actor_id",
-      "org_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "title",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "discussion.destroy",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "repo",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "title",
+      "created_at"
     ]
   },
   {
@@ -2082,21 +3193,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "team",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "number",
-      "org",
-      "title",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id"
+      "team",
+      "created_at",
+      "number",
+      "title",
+      "operation_type"
     ]
   },
   {
@@ -2104,18 +3227,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user_id",
-      "actor",
       "number",
-      "user",
-      "created_at",
-      "request_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2123,18 +3259,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "_document_id",
-      "request_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "number",
       "team",
       "created_at"
@@ -2145,21 +3292,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "_document_id",
-      "title",
-      "user",
-      "user_agent",
-      "org",
-      "operation_type",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "team",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type",
+      "team",
       "number"
     ]
   },
@@ -2168,17 +3326,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2189,16 +3361,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2209,18 +3395,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
       "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2231,17 +3431,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was created.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "org_id",
       "action",
-      "request_id",
-      "org",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -2250,17 +3463,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "actor_id",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -2269,22 +3495,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2293,22 +3528,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2316,28 +3561,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2346,27 +3597,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2375,25 +3634,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2402,26 +3669,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2430,21 +3704,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2453,22 +3739,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2477,25 +3773,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2504,22 +3809,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2528,21 +3845,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -2553,19 +3880,30 @@
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2574,20 +3912,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2596,19 +3944,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2617,23 +3976,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2641,18 +4009,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2663,48 +4041,68 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type"
-    ]
-  },
-  {
-    "action": "hook.active_changed",
-    "description": "A hook's active status was updated.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "hook.active_changed",
+    "description": "A hook's active status was updated.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -2712,25 +4110,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -2738,26 +4145,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -2766,25 +4182,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -2792,26 +4217,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -2819,21 +4253,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -2842,19 +4287,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -2862,42 +4320,67 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "application_client_id"
-    ]
-  },
-  {
-    "action": "integration_installation.create",
-    "description": "A GitHub App was installed.",
-    "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
-    "fields": [
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
+      "created_at",
+      "application_client_id"
+    ]
+  },
+  {
+    "action": "integration_installation.create",
+    "description": "A GitHub App was installed.",
+    "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
+    "fields": [
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -2908,20 +4391,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2931,24 +4426,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2959,23 +4465,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2986,21 +4504,33 @@
     "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
       "operation_type",
-      "@timestamp",
       "integration",
-      "action",
-      "user_agent",
       "reason",
-      "_document_id",
-      "org",
-      "org_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -3011,20 +4541,32 @@
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
       "@timestamp",
-      "actor_id",
-      "org",
       "_document_id",
-      "requester",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "requester",
       "created_at",
       "url",
-      "org_id",
-      "request_id",
       "operation_type",
-      "actor",
       "integration",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -3034,20 +4576,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -3057,19 +4612,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -3078,20 +4647,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
-      "user_id",
-      "user_agent",
-      "name",
-      "user",
-      "operation_type",
-      "actor_id",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "integration",
+      "name",
+      "operation_type",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -3101,20 +4683,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -3123,20 +4718,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -3145,20 +4753,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -3166,19 +4786,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -3187,19 +4820,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -3208,17 +4854,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -3231,21 +4890,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -3259,17 +4931,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -3281,39 +4966,61 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "actor_id",
-      "created_at",
-      "org_id",
       "action",
-      "@timestamp",
-      "user"
-    ]
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "ip_allow_list.disable_for_installed_apps",
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3321,20 +5028,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "user_id",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
-      "_document_id",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "actor_id",
       "operation_type",
-      "org",
       "created_at"
     ]
   },
@@ -3343,19 +5059,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3363,24 +5090,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3388,24 +5123,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "ip_allow_list_entry",
-      "org",
-      "operation_type",
-      "created_at",
-      "active",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at",
+      "active"
     ]
   },
   {
@@ -3413,19 +5156,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "actor_id",
       "ip_allow_list_entry",
-      "active",
-      "org_id",
-      "@timestamp"
+      "active"
     ]
   },
   {
@@ -3433,22 +5189,31 @@
     "description": "A comment on an issue was deleted from the repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "org",
-      "repo",
-      "actor_id",
       "@timestamp",
-      "created_at",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "oauth_application_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -3456,24 +5221,30 @@
     "description": "A comment on an issue was pinned to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3484,19 +5255,29 @@
     "description": "A comment on an issue was unpinned from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3507,22 +5288,31 @@
     "description": "A comment on an issue (other than the initial one) changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "action",
-      "repo_id",
-      "org_id",
-      "created_at",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "request_id",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
-      "oauth_application_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -3530,20 +5320,30 @@
     "description": "An issue was marked as blocked by another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3554,19 +5354,30 @@
     "description": "The blocked by relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3576,20 +5387,30 @@
     "description": "An issue was marked as blocking another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3600,20 +5421,30 @@
     "description": "The blocking relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3624,21 +5455,31 @@
     "description": "An issue was deleted from the repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue",
     "fields": [
-      "user",
-      "actor_id",
-      "created_at",
-      "title",
       "@timestamp",
       "_document_id",
-      "request_id",
-      "actor",
-      "user_id",
       "action",
-      "operation_type",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type"
     ],
     "docs_reference_titles": "Deleting an issue"
   },
@@ -3647,23 +5488,33 @@
     "description": "An issue was pinned to a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
       "action",
       "actor",
-      "operation_type",
-      "owner_type",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "number",
-      "repo",
-      "event",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "owner_type",
+      "number",
+      "event"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3672,22 +5523,32 @@
     "description": "An issue was transferred to another repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "owner_type",
-      "actor_id",
       "number",
-      "repo",
       "operation_type",
-      "_document_id",
-      "repo_id",
-      "action",
-      "request_id",
-      "created_at",
-      "actor",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Transferring an issue to another repository"
   },
@@ -3696,20 +5557,32 @@
     "description": "An issue type was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "issue_type_name",
-      "description",
-      "color",
-      "enabled",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "issue_type_name",
+      "description",
+      "color",
+      "enabled",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3720,20 +5593,32 @@
     "description": "An issue type was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issue_type_name",
       "description",
       "color",
       "enabled",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3744,11 +5629,28 @@
     "description": "An issue type was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issue_type_name",
       "description",
       "color",
@@ -3757,11 +5659,6 @@
       "old_description",
       "old_color",
       "old_enabled",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3772,24 +5669,33 @@
     "description": "An issue was unpinned from a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
-      "event",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
-      "action",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "operation_type",
-      "_document_id",
-      "number",
-      "owner_type",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "token_scopes",
-      "request_access_security_header"
+      "user_agent",
+      "event",
+      "created_at",
+      "operation_type",
+      "number",
+      "owner_type"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3798,19 +5704,30 @@
     "description": "The ability for enterprise members to delete issues was disabled  Members cannot delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
-      "operation_type",
-      "request_id",
-      "actor_id",
-      "user_id",
-      "created_at",
       "_document_id",
+      "action",
       "actor",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "org_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3819,18 +5736,29 @@
     "description": "The ability for enterprise members to delete issues was enabled  Members can delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -3840,19 +5768,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user",
-      "request_id",
-      "actor",
-      "business_id",
-      "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3861,18 +5800,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3880,21 +5831,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -3902,44 +5866,70 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
-      "org",
-      "secondary_category",
-      "operation_type",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id"
-    ]
-  },
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
+      "secondary_category",
+      "operation_type",
+      "created_at"
+    ]
+  },
   {
     "action": "marketplace_listing.create",
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -3947,19 +5937,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -3969,22 +5972,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -3992,22 +6008,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -4015,20 +6044,30 @@
     "description": "The ability for members to publish GitHub Pages sites was disabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4037,20 +6076,30 @@
     "description": "The ability for members to publish GitHub Pages sites was enabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4059,21 +6108,30 @@
     "description": "The ability for members to publish private GitHub Pages was disabled  Members cannot publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4082,22 +6140,30 @@
     "description": "The ability for members to publish private GitHub Pages was enabled  Members can publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4106,21 +6172,30 @@
     "description": "The ability for members to publish public GitHub Pages was disabled  Members cannot publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4129,22 +6204,30 @@
     "description": "The ability for members to publish public GitHub Pages was enabled  Members can publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4153,19 +6236,30 @@
     "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "operation_type",
       "user_agent",
-      "actor",
-      "actor_id",
-      "business_id",
-      "@timestamp",
-      "created_at",
-      "action"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -4174,18 +6268,29 @@
     "description": "The ability for enterprise members to delete repositories was disabled  Members cannot delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "request_id",
-      "org",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "actor",
       "operation_type",
-      "org_id",
-      "action",
-      "@timestamp",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -4195,21 +6300,30 @@
     "description": "The ability for enterprise members to delete repositories was enabled  Members can delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "action",
-      "org_id",
-      "user_id",
-      "business",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
-      "org",
-      "operation_type",
-      "user_agent"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -4220,16 +6334,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -4238,21 +6363,30 @@
     "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "created_at",
-      "user_id",
       "business_id",
-      "user",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "org_id",
-      "@timestamp"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4261,19 +6395,30 @@
     "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "user_id",
-      "business",
-      "business_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "actor_id"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4282,19 +6427,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4302,21 +6459,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
-      "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "public_repo",
       "created_at",
       "operation_type"
     ]
@@ -4326,16 +6492,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4345,18 +6524,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4366,14 +6558,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -4381,19 +6589,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -4401,18 +6620,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4420,23 +6651,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -4444,16 +6683,30 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "org_id",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4461,24 +6714,32 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
-      "repo_id",
       "operation_type",
-      "@timestamp",
-      "user_agent",
       "created_at",
-      "org",
-      "action",
-      "_document_id",
-      "repo",
-      "actor",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4486,15 +6747,28 @@
     "description": "A network configuration for a hosted compute service was created.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4512,18 +6786,31 @@
     "description": "A network configuration for a hosted compute service was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "actor_is_bot",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot",
       "network_configuration_id"
     ],
     "docs_reference_titles": "About networking for hosted compute products in your enterprise"
@@ -4533,15 +6820,28 @@
     "description": "A network configuration for a hosted compute service was updated.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4558,20 +6858,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4580,20 +6892,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4602,20 +6926,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4624,20 +6960,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4646,19 +6994,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4667,20 +7028,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4689,20 +7062,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4711,38 +7096,62 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
-      "user",
-      "action"
-    ],
-    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
-  },
-  {
-    "action": "org.accept_business_invitation",
-    "description": "An invitation sent to an organization to join an enterprise was accepted.",
-    "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
+    ],
+    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+  },
+  {
+    "action": "org.accept_business_invitation",
+    "description": "An invitation sent to an organization to join an enterprise was accepted.",
+    "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4753,20 +7162,30 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
   },
@@ -4775,19 +7194,29 @@
     "description": "An organization prevented access to resources by users with the given two-factor method.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "two_factor_method",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "two_factor_method",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4798,21 +7227,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -4821,24 +7260,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4846,21 +7295,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -4868,20 +7327,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4889,22 +7358,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4912,20 +7389,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4933,22 +7420,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4956,21 +7451,31 @@
     "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "new_policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -4980,19 +7485,30 @@
     "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -5001,19 +7517,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -5023,15 +7550,28 @@
     "description": "Third-party application access for outside collaborators was disabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5042,15 +7582,28 @@
     "description": "Third-party application access for outside collaborators was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5061,15 +7614,28 @@
     "description": "The organization was archived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5079,17 +7645,30 @@
     "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
   },
@@ -5098,21 +7677,32 @@
     "description": "An export of the organization's Git events was created.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "start",
       "end",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization"
   },
@@ -5121,16 +7711,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -5139,18 +7742,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
-      "actor",
-      "user_agent",
-      "org_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "blocked_user",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -5159,19 +7775,30 @@
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -5181,22 +7808,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "email",
-      "@timestamp",
-      "actor",
-      "action",
       "operation_type",
-      "user_agent",
-      "org",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -5204,19 +7842,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -5224,16 +7873,28 @@
     "description": "Cleared two-factor authentication restrictions for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5244,23 +7905,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5268,21 +7937,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5290,23 +7969,31 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5314,23 +8001,31 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5338,10 +8033,28 @@
     "description": "Enablement for Code Security features on new repositories has been locked for this organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "action",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5351,10 +8064,28 @@
     "description": "Enablement for Code Security features on new repositories has been unlocked for this organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "action",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5364,21 +8095,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -5387,21 +8127,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -5410,20 +8159,31 @@
     "description": "Access to use Codespaces on internal and private repositories was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "enablement",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "enablement",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization"
   },
@@ -5432,21 +8192,31 @@
     "description": "Ownership and payment for codespaces was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "owner_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
   },
@@ -5455,16 +8225,29 @@
     "description": "A team has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5474,16 +8257,29 @@
     "description": "A team has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5493,19 +8289,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -5514,17 +8321,30 @@
     "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -5533,21 +8353,30 @@
     "description": "A user has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5555,21 +8384,30 @@
     "description": "A user has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5577,16 +8415,29 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
@@ -5596,17 +8447,30 @@
     "description": "The interaction limit for prior contributors only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5615,17 +8479,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5635,16 +8512,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5653,17 +8543,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5672,17 +8575,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5691,22 +8607,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -5715,17 +8639,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5736,15 +8671,28 @@
     "description": "Server statistics were exported for the organization.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5755,18 +8703,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
-      "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -5775,20 +8735,31 @@
     "description": "A GitHub Actions secret was created for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5797,20 +8768,32 @@
     "description": "A GitHub Actions variable was created for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5819,21 +8802,33 @@
     "description": "A Codespaces or Dependabot secret was created for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5841,21 +8836,30 @@
     "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "org_id",
-      "business",
-      "action",
       "@timestamp",
-      "org",
       "_document_id",
-      "business_id",
+      "action",
       "actor",
-      "token_scopes",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "actor_is_bot",
       "oauth_credential_type",
       "managed_oauth_access_id",
@@ -5871,24 +8875,32 @@
     "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
-      "created_at",
-      "org_id",
-      "business_id",
-      "operation_type",
-      "request_id",
       "_document_id",
       "action",
+      "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "token_scopes",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot",
       "oauth_credential_type",
-      "request_access_security_header",
       "managed_oauth_access_id",
       "managed_token_id",
       "managed_oauth_scopes",
@@ -5902,21 +8914,32 @@
     "description": "An owner revoked authorized credentials.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "oauth_application_id",
-      "org_id",
       "operation_type",
-      "action",
-      "business",
-      "request_id",
       "created_at",
-      "business_id",
-      "actor_id",
-      "_document_id",
-      "user_agent",
       "oauth_credential_type",
       "managed_oauth_access_id",
       "managed_token_id",
@@ -5931,18 +8954,30 @@
     "description": "An organization was deleted by a user or staff.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "org_id",
-      "org",
       "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5950,38 +8985,61 @@
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
-  },
-  {
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
+  },
+  {
     "action": "org.disable_oauth_app_restrictions",
     "description": "Third-party application access restrictions for an organization were disabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization"
@@ -5991,19 +9049,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -6012,14 +9081,31 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sso_url",
       "issuer",
-      "action",
-      "@timestamp",
-      "_document_id",
       "created_at",
-      "org",
       "operation_type"
     ]
   },
@@ -6028,21 +9114,30 @@
     "description": "Display of IP addresses within audit log events for the organization was disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -6051,17 +9146,30 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6069,19 +9177,30 @@
     "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6089,19 +9208,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
-      "action",
-      "actor_id",
-      "org_id"
+      "created_at"
     ]
   },
   {
@@ -6109,19 +9239,30 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -6130,17 +9271,30 @@
     "description": "Third-party application access restrictions for an organization were enabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "operation_type",
-      "org",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization"
   },
@@ -6149,19 +9303,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user",
-      "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -6170,19 +9335,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "sso_url",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "issuer",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "sso_url",
+      "created_at",
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -6191,21 +9369,30 @@
     "description": "Display of IP addresses within audit log events for the organization was enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -6214,17 +9401,30 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
   },
@@ -6233,17 +9433,30 @@
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -6252,18 +9465,31 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
-      "org",
-      "user_agent",
-      "request_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "manager",
       "operation_type",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6271,23 +9497,32 @@
     "description": "A new user was invited to join an organization.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
     "fields": [
-      "org",
-      "user_id",
-      "invitation_id",
-      "org_id",
-      "user",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -6296,17 +9531,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6316,19 +9562,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6336,19 +9593,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6356,19 +9624,31 @@
     "description": "Access to an organization was granted for an OAuth App.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "operation_type",
-      "org_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization"
@@ -6378,20 +9658,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -6400,18 +9691,31 @@
     "description": "Access was disabled for an OAuth App that was previously approved.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization",
     "fields": [
-      "request_id",
-      "url",
-      "created_at",
-      "org_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
@@ -6421,19 +9725,31 @@
     "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "url",
-      "org_id",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "url",
       "oauth_application_name"
     ]
   },
@@ -6442,20 +9758,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -6465,16 +9792,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6482,20 +9822,31 @@
     "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "reason",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "reason",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -6504,20 +9855,30 @@
     "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -6526,19 +9887,30 @@
     "description": "An organization owner downloaded the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6547,19 +9919,30 @@
     "description": "An organization owner generated the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6568,19 +9951,30 @@
     "description": "An organization owner printed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6589,19 +9983,30 @@
     "description": "An organization owner viewed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6610,19 +10015,31 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -6631,20 +10048,31 @@
     "description": "A GitHub Actions secret was removed from an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -6653,21 +10081,31 @@
     "description": "A GitHub Actions variable was removed from an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -6676,18 +10114,29 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
@@ -6697,19 +10146,29 @@
     "description": "Removed a two-factor authentication method restriction for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "two_factor_method",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "two_factor_method",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -6720,22 +10179,32 @@
     "description": "A Codespaces or Dependabot secret was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6743,43 +10212,61 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "org.remove_outside_collaborator",
-    "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "org",
-      "user",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "action",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "org.remove_outside_collaborator",
+    "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6787,21 +10274,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -6809,18 +10306,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -6829,19 +10338,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
-      "old_login",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_login",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6849,14 +10370,28 @@
     "description": "Triggered when a required workflow is created.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6867,14 +10402,28 @@
     "description": "Triggered when a required workflow is deleted.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6885,14 +10434,28 @@
     "description": "Triggered when a required workflow is updated.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6903,20 +10466,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -6925,18 +10498,29 @@
     "description": "A member's linked identity was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
       "user_id",
-      "@timestamp",
-      "action",
-      "actor_id",
       "user_agent",
-      "_document_id",
-      "request_id",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
@@ -6946,19 +10530,30 @@
     "description": "A member's SAML session was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
-      "actor_id",
-      "created_at",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
   },
@@ -6967,21 +10562,33 @@
     "description": "A self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -6991,21 +10598,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7014,20 +10631,31 @@
     "description": "A self-hosted runner group was renamed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7036,23 +10664,33 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -7061,23 +10699,31 @@
     "description": "A self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7086,19 +10732,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -7107,25 +10766,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7134,21 +10804,32 @@
     "description": "The visibility of a self-hosted runner group was updated via the REST API.",
     "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
   },
@@ -7157,10 +10838,28 @@
     "description": "Enablement for Secret Protection features on new repositories has been locked for this organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "action",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7170,10 +10869,28 @@
     "description": "Enablement for Secret Protection features on new repositories has been unlocked for this organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "action",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7183,21 +10900,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7207,21 +10933,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7231,20 +10966,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7253,22 +10998,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7277,21 +11030,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7300,21 +11062,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7323,22 +11094,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7347,21 +11126,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7370,22 +11158,30 @@
     "description": "Generic secrets have been disabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7393,22 +11189,30 @@
     "description": "Generic secrets have been enabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7416,21 +11220,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7440,21 +11253,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7464,19 +11286,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7486,21 +11319,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7510,21 +11352,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7534,19 +11385,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7556,22 +11418,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7580,46 +11450,62 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "programmatic_access_type"
-    ],
-    "docs_reference_titles": "About push protection"
-  },
-  {
-    "action": "org.secret_scanning_push_protection_custom_message_updated",
-    "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "About push protection"
+  },
+  {
+    "action": "org.secret_scanning_push_protection_custom_message_updated",
+    "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7628,21 +11514,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7651,21 +11546,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7674,22 +11578,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7698,22 +11610,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7722,12 +11642,28 @@
     "description": "The push protection setting was updated for a secret type for your organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "push_protection_setting",
       "secret_type",
       "secret_type_display_name",
@@ -7740,12 +11676,28 @@
     "description": "The push protection pattern configuration was updated for your organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at"
     ],
     "docs_reference_titles": "About push protection"
@@ -7755,26 +11707,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -7783,26 +11744,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7810,28 +11779,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7839,26 +11816,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7866,15 +11851,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7883,15 +11885,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7900,7 +11919,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -7915,18 +11955,28 @@
     "description": "The cache retention policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -7938,18 +11988,28 @@
     "description": "The cache storage policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -7961,20 +12021,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -7983,16 +12054,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -8003,18 +12087,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -8023,17 +12120,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8041,18 +12151,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -8061,18 +12183,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -8081,18 +12216,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -8101,22 +12248,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issuer",
-      "business",
       "operation_type",
       "created_at",
-      "request_id",
-      "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8124,21 +12281,32 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
   },
@@ -8147,19 +12315,30 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8170,15 +12349,28 @@
     "description": "The organization was unarchived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8188,19 +12380,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
-      "oauth_application_id",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "blocked_user",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -8209,45 +12414,68 @@
     "description": "A GitHub Actions secret was updated for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "created_at",
-      "key",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "programmatic_access_type"
-    ],
-    "docs_reference_titles": "Using secrets in GitHub Actions"
-  },
-  {
-    "action": "org.update_actions_settings",
-    "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
-    "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "key",
+      "operation_type"
+    ],
+    "docs_reference_titles": "Using secrets in GitHub Actions"
+  },
+  {
+    "action": "org.update_actions_settings",
+    "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
+    "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -8256,20 +12484,32 @@
     "description": "A GitHub Actions variable was updated for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -8278,20 +12518,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -8299,18 +12551,30 @@
     "description": "The settings policy for immutable releases was updated for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_policy",
       "new_policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8321,22 +12585,33 @@
     "description": "A Codespaces or Dependabot secret was updated for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8345,20 +12620,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -8366,17 +12652,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -8386,20 +12685,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -8408,36 +12718,62 @@
     "description": "The name of the default branch was changed for new repositories in the organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
+  },
   {
     "action": "org.update_repo_self_hosted_runners_policy",
     "description": "The repository self-hosted runners policy was updated",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_repo_runners_policy",
       "new_repo_runners_policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8448,19 +12784,32 @@
     "description": "An organization's SAML provider settings were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "issuer",
-      "org",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -8468,18 +12817,30 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "org",
-      "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
@@ -8488,21 +12849,31 @@
     "description": "An organization's custom property value was manually set for the first time.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8514,21 +12885,31 @@
     "description": "An organization's custom property value was deleted.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8540,18 +12921,30 @@
     "description": "A default label was created for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
-      "_document_id",
-      "action",
-      "created_at",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label"
   },
@@ -8560,17 +12953,30 @@
     "description": "A default label was deleted for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label"
   },
@@ -8579,17 +12985,30 @@
     "description": "A default label was edited for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label",
     "fields": [
-      "org",
-      "created_at",
       "@timestamp",
-      "actor",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label"
   },
@@ -8598,20 +13017,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "org_id",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -8620,16 +13052,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8638,14 +13085,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -8656,16 +13118,31 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "operation_type",
-      "domain_name",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
       "_document_id",
-      "actor_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "domain_name",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8674,16 +13151,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -8693,17 +13183,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8713,16 +13214,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -8732,20 +13246,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -8753,19 +13277,30 @@
     "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor",
-      "business_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
       "user_agent",
-      "_document_id",
       "created_at",
-      "operation_type",
-      "request_id",
-      "business"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -8774,19 +13309,30 @@
     "description": "Organization projects were disabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -8795,44 +13341,65 @@
     "description": "Organization projects were enabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor_id",
-      "org_id",
-      "created_at",
-      "user_id",
-      "org",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor",
-      "request_id",
-      "user",
       "action",
-      "operation_type"
-    ],
-    "docs_reference_titles": "Enforcing policies for projects in your enterprise"
-  },
-  {
-    "action": "organization_role.assign",
-    "description": "An organization role was assigned to a user or team.",
-    "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
-    "fields": [
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "Enforcing policies for projects in your enterprise"
+  },
+  {
+    "action": "organization_role.assign",
+    "description": "An organization role was assigned to a user or team.",
+    "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About custom organization roles"
   },
@@ -8841,25 +13408,32 @@
     "description": "A custom organization role was created in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8871,25 +13445,32 @@
     "description": "A custom organization role was deleted in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8900,19 +13481,30 @@
     "description": "A user or team was unassigned an organization role.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type"
     ],
@@ -8923,26 +13515,33 @@
     "description": "A custom organization role was edited in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
       "old_role_permissions",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -8955,22 +13554,33 @@
     "description": "An organization's default project base role was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_project_base_role",
-      "new_project_base_role",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_project_base_role",
+      "new_project_base_role",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8978,20 +13588,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -9001,23 +13622,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -9026,21 +13658,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -9051,21 +13694,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -9074,20 +13730,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -9096,17 +13766,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9117,20 +13802,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -9139,18 +13838,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9158,16 +13869,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9175,18 +13900,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9194,18 +13931,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9216,22 +13966,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9239,22 +13998,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "programmatic_access_type",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9262,18 +14030,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9284,18 +14065,28 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9306,18 +14097,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9328,23 +14129,34 @@
     "description": "A personal access token expiration limit was set.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "token_expiration",
       "old_token_expiration",
       "exempt_administrators",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9352,21 +14164,32 @@
     "description": "A personal access token expiration limit was unset.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "programmatic_access_type",
-      "old_token_expiration",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_token_expiration",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9374,17 +14197,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9395,18 +14231,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9418,17 +14267,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9440,20 +14302,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9465,20 +14336,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9490,20 +14370,29 @@
     "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9515,20 +14404,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9540,15 +14438,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9558,17 +14471,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9578,15 +14502,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9596,19 +14535,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "business_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9616,23 +14566,30 @@
     "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "created_at",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
-      "repo",
       "action",
-      "user_agent",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "request_id",
-      "user_id",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9640,23 +14597,30 @@
     "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "repo",
-      "org",
-      "business",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org_id",
-      "created_at",
-      "business_id"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9664,17 +14628,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9684,17 +14659,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9704,17 +14690,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9724,17 +14721,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9744,17 +14752,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -9764,17 +14785,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9782,25 +14816,36 @@
     "description": "A project's base role was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_project_base_role",
       "new_project_base_role",
       "project_number",
       "public_project",
-      "business",
       "project_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9808,20 +14853,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -9831,25 +14887,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -9857,20 +14925,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9878,25 +14958,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9904,17 +14996,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9922,17 +15027,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9940,18 +15058,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -9960,18 +15090,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -9980,19 +15122,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -10000,17 +15153,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -10022,22 +15188,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -10045,19 +15220,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10065,17 +15251,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10083,39 +15282,62 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "actor"
-    ]
-  },
-  {
-    "action": "project.update_user_permission",
-    "description": "A user was added to or removed from a project board or had their permission level changed.",
-    "docs_reference_links": "N/A",
-    "fields": [
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
+      "team"
+    ]
+  },
+  {
+    "action": "project.update_user_permission",
+    "description": "A user was added to or removed from a project board or had their permission level changed.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10123,18 +15345,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -10143,18 +15377,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -10163,16 +15409,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -10184,21 +15443,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -10206,22 +15477,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -10230,29 +15511,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10260,24 +15546,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "repo_id",
-      "user_id",
       "@timestamp",
-      "user_agent",
-      "repo",
-      "name",
-      "org_id",
-      "user",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -10288,21 +15582,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -10313,22 +15617,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10336,24 +15650,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "authorized_actors_only",
       "authorized_actors",
       "created_at",
-      "user_agent",
       "name",
-      "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
-      "actor_id",
-      "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -10361,30 +15685,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -10394,28 +15725,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -10426,23 +15765,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -10450,22 +15798,32 @@
     "description": "Branch deletion was enabled or disabled for a protected branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "operation_type",
-      "request_id",
-      "repo",
       "@timestamp",
-      "org_id",
-      "org",
-      "action",
-      "allow_deletions_enforcement_level",
       "_document_id",
-      "created_at",
-      "actor_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_deletions_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10473,23 +15831,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "actor_id",
-      "name",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo",
-      "operation_type",
-      "request_id",
-      "allow_force_pushes_enforcement_level",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_force_pushes_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10497,24 +15864,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "ignore_approvals_from_contributors",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -10523,22 +15899,32 @@
     "description": "Required linear commit history was enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "operation_type",
       "actor",
-      "linear_history_requirement_enforcement_level",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "linear_history_requirement_enforcement_level",
       "name",
-      "org_id",
-      "repo_id",
-      "org",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -10546,24 +15932,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "lock_allows_fetch_and_merge",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10572,27 +15967,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10601,18 +16003,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -10623,24 +16038,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -10648,25 +16072,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -10674,22 +16105,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -10697,22 +16138,33 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
   },
@@ -10721,22 +16173,32 @@
     "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "required_approving_review_count",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10744,25 +16206,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
     ]
   },
   {
@@ -10770,22 +16239,32 @@
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
       "action",
       "actor",
       "actor_id",
-      "signature_requirement_enforcement_level",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "programmatic_access_type"
+      "operation_type",
+      "name",
+      "created_at",
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -10793,22 +16272,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "created_at",
-      "repo_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "name",
-      "actor",
-      "repo",
       "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
+      "strict_required_status_checks_policy"
     ]
   },
   {
@@ -10816,23 +16305,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -10841,24 +16341,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -10867,20 +16378,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10889,21 +16414,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -10913,22 +16451,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "key",
-      "fingerprint",
-      "read_only",
-      "repo_id",
-      "operation_type",
-      "created_at",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "fingerprint",
+      "read_only",
+      "operation_type",
+      "created_at",
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10937,25 +16487,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10964,23 +16524,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10989,18 +16560,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -11010,21 +16595,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -11033,19 +16629,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -11056,23 +16665,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -11082,17 +16703,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11100,19 +16735,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -11120,19 +16768,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "pull_request_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "pull_request_url",
-      "token_scopes",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
+      "operation_type",
+      "created_at",
+      "pull_request_url",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -11142,21 +16803,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -11165,27 +16837,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "pull_request_url",
       "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11193,23 +16872,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -11218,18 +16909,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -11237,19 +16942,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -11259,20 +16976,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
-      "repo",
-      "created_at",
-      "request_id",
-      "comment_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "comment_id",
+      "operation_type"
     ]
   },
   {
@@ -11280,18 +17008,31 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "_document_id",
-      "@timestamp",
-      "comment_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "comment_id"
     ]
   },
   {
@@ -11299,21 +17040,33 @@
     "description": "A review on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -11321,20 +17074,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -11343,19 +17109,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -11365,22 +17145,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -11389,21 +17179,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -11412,25 +17211,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -11439,23 +17245,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -11464,24 +17278,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -11490,23 +17311,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -11516,22 +17345,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -11540,45 +17378,68 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
-      "actor_id",
-      "operation_type",
       "action",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot"
-    ]
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type",
+      "public_repo",
+      "actor_is_bot"
+    ]
   },
   {
     "action": "repo.code_scanning_analysis_deleted",
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -11587,24 +17448,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11612,24 +17481,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11637,24 +17514,32 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11662,24 +17547,32 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11687,23 +17580,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11714,17 +17616,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -11734,17 +17648,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -11754,25 +17680,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11781,26 +17713,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11809,25 +17749,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "query_suite",
       "threat_model",
       "languages",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -11837,19 +17786,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to this repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -11858,19 +17818,30 @@
     "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11878,17 +17849,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11897,15 +17881,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -11916,16 +17913,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11935,17 +17945,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11955,38 +17978,62 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
-  },
-  {
-    "action": "repo.config.enable_sockpuppet_disallowed",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+  },
+  {
+    "action": "repo.config.enable_sockpuppet_disallowed",
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11995,26 +18042,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -12023,30 +18076,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -12056,20 +18114,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12078,25 +18147,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12105,23 +18182,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12129,25 +18217,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -12157,23 +18254,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -12183,24 +18289,32 @@
     "description": "The setting for immutable releases was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -12209,20 +18323,30 @@
     "description": "The setting for immutable releases was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12233,23 +18357,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -12257,21 +18391,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12279,21 +18423,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -12301,22 +18455,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -12324,21 +18487,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -12346,20 +18519,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -12367,22 +18551,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12390,18 +18583,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -12409,22 +18616,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -12432,21 +18649,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12454,18 +18681,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -12474,22 +18713,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12498,24 +18746,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12524,23 +18780,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12548,26 +18814,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -12576,21 +18847,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -12599,25 +18879,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12625,22 +18911,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -12649,25 +18945,34 @@
     "description": "A branch was renamed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "old_branch",
-      "new_branch",
-      "default_branch",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "old_branch",
+      "new_branch",
+      "default_branch",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch"
@@ -12677,19 +18982,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12697,17 +19013,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12716,17 +19047,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12735,7 +19081,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -12750,22 +19117,30 @@
     "description": "The cache retention policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12777,22 +19152,30 @@
     "description": "The cache storage policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12804,23 +19187,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -12830,20 +19222,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -12854,21 +19257,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -12877,22 +19291,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -12901,21 +19325,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -12924,22 +19359,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -12950,16 +19395,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -12969,22 +19425,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -12993,23 +19460,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -13019,19 +19496,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -13039,21 +19526,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -13062,24 +19559,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13087,25 +19593,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -13114,24 +19627,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13140,25 +19663,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -13167,22 +19698,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13191,26 +19731,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -13218,31 +19766,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13251,22 +19806,30 @@
     "description": "Someone closed a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories",
     "fields": [
-      "actor",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "created_at",
-      "repo_id",
-      "_document_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "About repository security advisories"
   },
@@ -13275,18 +19838,29 @@
     "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "_document_id",
+      "operation_type",
       "created_at"
     ]
   },
@@ -13295,17 +19869,30 @@
     "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -13314,21 +19901,30 @@
     "description": "GitHub withdrew a security advisory that was published in error.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13336,18 +19932,30 @@
     "description": "Someone opened a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
       "repo_id",
-      "action",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13355,21 +19963,30 @@
     "description": "Someone published a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "repo_id",
       "_document_id",
-      "repo",
-      "business_id",
-      "business",
-      "request_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "org"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13377,17 +19994,30 @@
     "description": "Someone reopened as draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "repo",
-      "action",
-      "created_at",
       "@timestamp",
-      "request_id",
-      "actor_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "public_repo"
     ]
   },
@@ -13396,21 +20026,30 @@
     "description": "Someone edited a draft or published security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "repo_id",
-      "org_id",
       "business",
-      "actor",
-      "user_agent",
-      "created_at",
-      "_document_id",
       "business_id",
-      "repo",
-      "action",
-      "operation_type",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13418,24 +20057,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -13444,24 +20089,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -13470,25 +20121,31 @@
     "description": "Code security was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13497,25 +20154,31 @@
     "description": "Code security was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13524,19 +20187,30 @@
     "description": "Data use settings were disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "repo_id",
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -13545,21 +20219,30 @@
     "description": "Data use settings were enabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "org",
-      "user_id",
-      "repo_id",
       "@timestamp",
-      "request_id",
-      "actor",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org_id",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -13568,23 +20251,30 @@
     "description": "The dependency graph was disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "repo_id",
-      "operation_type",
-      "user_id",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
-      "@timestamp",
-      "org_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -13593,24 +20283,31 @@
     "description": "The dependency graph was enabled for a private repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor_id",
-      "repo_id",
+      "created_at",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13619,21 +20316,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -13641,21 +20348,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13663,21 +20380,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -13685,20 +20413,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -13706,21 +20446,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13728,19 +20479,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "actor",
-      "invitee",
-      "action",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -13748,17 +20512,31 @@
     "description": "An organization has reached their repository limit.",
     "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "limit",
       "count",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -13769,17 +20547,31 @@
     "description": "An organization is approaching their repository limit.",
     "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "limit",
       "count",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -13790,19 +20582,30 @@
     "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise  Organization owners can now control their repository projects settings.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "user_agent",
-      "user",
-      "business_id",
-      "business",
-      "operation_type",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -13811,20 +20614,30 @@
     "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
       "@timestamp",
-      "repo",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "repo_id",
-      "actor",
-      "request_id",
-      "programmatic_access_type"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13833,20 +20646,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
       "created_at",
-      "org_id",
-      "action",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "actor_id",
-      "repo"
+      "operation_type"
     ]
   },
   {
@@ -13854,31 +20676,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -13887,19 +20717,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -13907,8 +20748,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -13917,23 +20757,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -13958,26 +20807,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -13986,26 +20841,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -14014,23 +20875,30 @@
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14040,23 +20908,30 @@
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14066,24 +20941,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14093,24 +20975,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -14119,24 +21008,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14146,23 +21042,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14172,23 +21075,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14197,22 +21108,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14220,24 +21139,32 @@
     "description": "Generic secrets have been disabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14245,22 +21172,31 @@
     "description": "Generic secrets have been enabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14269,24 +21205,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -14295,24 +21239,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -14321,19 +21273,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14342,24 +21306,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14368,24 +21340,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14394,19 +21374,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14415,26 +21407,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14443,26 +21440,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14471,28 +21473,36 @@
     "description": "A code security configuration was applied to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14500,27 +21510,35 @@
     "description": "A code security configuration failed to attach to the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14528,28 +21546,36 @@
     "description": "A code security configuration was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14557,28 +21583,36 @@
     "description": "A code security configuration was removed due to a change in repository or enterprise settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14586,20 +21620,30 @@
     "description": "The repository visibility change setting was cleared for an organization or enterprise.",
     "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
       "business",
-      "action",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business_id",
-      "@timestamp",
       "user_agent",
-      "actor",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise"
   },
@@ -14608,20 +21652,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "org_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
-      "user_id",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14629,19 +21683,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "_document_id",
       "@timestamp",
-      "user_agent",
-      "user",
-      "created_at",
-      "org",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14649,29 +21714,37 @@
     "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -14680,29 +21753,37 @@
     "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -14711,19 +21792,32 @@
     "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
-      "operation_type",
-      "request_id",
-      "repo_id",
       "@timestamp",
-      "user_agent",
-      "alert_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "alert_id",
+      "created_at",
+      "alert_number"
     ],
     "docs_reference_titles": "About Dependabot alerts"
   },
@@ -14732,23 +21826,32 @@
     "description": "A Dependabot alert was manually dismissed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "alert_id",
-      "actor",
-      "repo",
       "created_at",
-      "org",
-      "_document_id",
-      "action",
-      "actor_id",
       "dismiss_reason",
-      "user",
       "dismiss_comment",
       "alert_number",
       "actor_is_bot"
@@ -14759,21 +21862,33 @@
     "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "public_repo",
       "owner",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "token_scopes",
       "alert_number"
     ]
   },
@@ -14782,26 +21897,34 @@
     "description": "A Dependabot alert was manually reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo",
-      "alert_number",
-      "request_access_security_header"
+      "alert_number"
     ]
   },
   {
@@ -14809,21 +21932,32 @@
     "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "alert_id",
-      "repo",
-      "operation_type",
-      "action",
-      "repo_id",
-      "_document_id",
-      "user_agent",
-      "request_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "operation_type",
+      "created_at",
+      "alert_number"
     ]
   },
   {
@@ -14831,21 +21965,35 @@
     "description": "A Dependabot alert was withdrawn.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
       "created_at",
       "active",
-      "action",
-      "repository_id",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type"
     ]
   },
@@ -14854,20 +22002,30 @@
     "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
     "fields": [
-      "org",
+      "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
-      "operation_type",
-      "created_at",
-      "actor",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
   },
@@ -14876,24 +22034,31 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -14901,26 +22066,32 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14928,23 +22099,30 @@
     "description": "Dependabot alerts was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "request_id",
-      "repo_id",
-      "action",
-      "actor_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "_document_id",
       "user_id",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14952,23 +22130,30 @@
     "description": "Dependabot alerts was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_agent",
-      "created_at",
       "@timestamp",
-      "repo_id",
+      "_document_id",
       "action",
-      "user",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor_id",
-      "_document_id",
-      "user_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -14977,24 +22162,31 @@
     "description": "A status check was marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "org",
-      "actor_id",
       "@timestamp",
-      "business",
-      "request_id",
-      "context",
-      "repo_id",
-      "action",
-      "repo",
       "_document_id",
-      "operation_type",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "created_at",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "context",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -15003,21 +22195,31 @@
     "description": "A status check was no longer marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "actor_id",
-      "actor",
-      "created_at",
-      "context",
-      "operation_type",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "repo_id",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
       "repo",
-      "programmatic_access_type"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "context",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -15026,18 +22228,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -15046,19 +22261,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -15067,22 +22294,33 @@
     "description": "A new custom repository role was created.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "name",
-      "owner",
-      "base_role",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "owner",
+      "base_role",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "role_permissions",
       "old_role_permissions"
     ],
@@ -15093,23 +22331,34 @@
     "description": "A custom repository role was deleted.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing custom repository roles for an organization"
   },
@@ -15118,23 +22367,34 @@
     "description": "A custom repository role was edited.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "old_role_permissions",
       "old_base_role"
     ],
@@ -15145,14 +22405,28 @@
     "description": "A user was assigned to a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15167,14 +22441,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15188,14 +22476,28 @@
     "description": "A secret scanning alert was deleted by GitHub.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15211,14 +22513,28 @@
     "description": "A secret scanning alert was leaked in a public repo.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15233,22 +22549,32 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
@@ -15257,14 +22583,28 @@
     "description": "A leaked secret was reported to the secret's provider by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "created_at",
@@ -15279,28 +22619,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -15308,25 +22657,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "number",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -15334,14 +22690,28 @@
     "description": "A user was unassigned from a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15356,14 +22726,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -15380,26 +22764,34 @@
     "description": "A request to close a secret scanning alert was approved by a user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "request_reviewer_comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15408,25 +22800,33 @@
     "description": "N/A",
     "docs_reference_links": "A reqeust to close a secret scanning alert was canceled by a user.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "A, reqeust, to, close, a, secret, scanning, alert, was, canceled, by, a, user."
@@ -15436,27 +22836,35 @@
     "description": "N/A",
     "docs_reference_links": "A user requested to close a secret scanning alert.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "reason",
       "comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "A, user, requested, to, close, a, secret, scanning, alert."
@@ -15466,26 +22874,34 @@
     "description": "A request to close a secret scanning alert was denied by a user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "request_reviewer_comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15494,19 +22910,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15515,19 +22942,30 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15536,20 +22974,30 @@
     "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15558,19 +23006,30 @@
     "description": "Secret scanning was enabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15579,14 +23038,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -15604,25 +23077,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -15631,24 +23112,32 @@
     "description": "A user canceled a request to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
@@ -15658,24 +23147,32 @@
     "description": "A user pushed a commit containing a secret for which there is an approved secret scanning push protection bypass request.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
@@ -15685,25 +23182,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -15713,25 +23218,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -15740,22 +23253,35 @@
     "description": "A secret scanning scan has completed on this repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "repo_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "source",
       "type",
       "source_slug",
       "type_slug",
       "started_at",
       "completed_at",
-      "repo",
       "public_repo",
-      "org",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "secret_types",
@@ -15769,10 +23295,28 @@
     "description": "A security configuration was created",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15787,15 +23331,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15813,22 +23350,33 @@
     "description": "A default security configuration setting for new repositories was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15837,22 +23385,33 @@
     "description": "A default security configuration setting for new repositories was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15861,10 +23420,28 @@
     "description": "A security configuration was deleted",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15879,15 +23456,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15904,15 +23474,30 @@
     "description": "A security configuration policy was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enforcement",
       "security_configuration_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15922,10 +23507,28 @@
     "description": "A security configuration was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15940,15 +23543,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15966,16 +23562,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15985,18 +23594,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -16005,16 +23627,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16024,15 +23659,28 @@
     "description": "An agreement for invoiced billing for GitHub Sponsors was signed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -16044,15 +23692,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -16062,15 +23723,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -16079,17 +23755,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -16098,17 +23787,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -16117,16 +23820,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -16136,14 +23852,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -16153,17 +23884,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -16172,17 +23916,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -16191,18 +23948,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16211,15 +23981,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -16229,16 +24013,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "actor",
-      "actor_id",
-      "user_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16246,15 +24043,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -16265,16 +24075,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -16284,17 +24107,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -16305,17 +24141,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -16326,18 +24175,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16347,16 +24207,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16366,16 +24239,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16387,17 +24273,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16406,19 +24305,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16427,21 +24339,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
-      "action",
-      "user_id",
-      "business",
-      "business_id",
-      "@timestamp",
-      "actor_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16450,19 +24371,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16471,15 +24403,28 @@
     "description": "Dependabot encrypted config was read.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "public_repo"
@@ -16490,20 +24435,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16511,18 +24470,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -16530,16 +24504,31 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "domain_name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16547,23 +24536,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16571,23 +24570,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16595,23 +24604,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16619,23 +24638,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16643,21 +24672,31 @@
     "description": "A member of an organization was added to a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
-      "user",
       "@timestamp",
-      "actor_id",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "org",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -16667,22 +24706,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -16691,20 +24739,30 @@
     "description": "A team was added to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team_type",
       "team",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -16715,20 +24773,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -16737,18 +24806,31 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
       "created_at",
       "operation_type",
-      "actor_id",
-      "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
@@ -16758,21 +24840,32 @@
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -16781,21 +24874,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -16804,19 +24907,31 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "team",
       "org_id",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
       "operation_type",
-      "_document_id",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -16825,19 +24940,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
       "business",
-      "action",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16845,19 +24971,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "request_id",
       "actor",
-      "org",
-      "created_at",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16865,18 +25002,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
       "@timestamp",
-      "action",
       "_document_id",
-      "user_agent",
-      "user_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -16885,19 +25033,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "actor",
-      "action",
-      "operation_type",
-      "team",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -16905,19 +25065,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "actor_id",
       "_document_id",
-      "team",
-      "created_at",
-      "org_id",
       "action",
-      "request_id",
-      "user_agent",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_access_security_header"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "team",
+      "created_at"
     ]
   },
   {
@@ -16925,22 +25097,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "team",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16948,22 +25129,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -16972,20 +25162,30 @@
     "description": "A team was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team_type",
       "team",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -16996,22 +25196,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -17021,43 +25230,64 @@
     "description": "A repository was removed from a team's control.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "org",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
     "action": "team.rename",
-    "description": "A team's name was changed.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "name",
-      "user_agent",
-      "created_at",
-      "team",
-      "operation_type",
-      "actor_id",
-      "org",
+    "description": "A team's name was changed.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -17066,17 +25296,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -17085,19 +25328,30 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -17106,19 +25360,30 @@
     "description": "The Okta credentials for team synchronization with a tenant were changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -17126,28 +25391,37 @@
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
       "operation_type",
       "created_at",
-      "user_agent",
       "permission",
       "new_repo_permission",
       "new_repo_base_role",
       "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_repo_base_role"
     ]
   },
   {
@@ -17155,23 +25429,38 @@
     "description": "Triggered when a user content edit is deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_content_id",
       "user_content_type",
       "created_at",
-      "user_agent",
       "deleted_by",
       "editor_id",
-      "_document_id",
       "deleted_at",
-      "action",
-      "actor_id",
       "editor",
       "deleted_by_id",
       "deleted_content",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -17179,16 +25468,30 @@
     "description": "A Dependabot rule was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17198,16 +25501,30 @@
     "description": "A Dependabot rule was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17217,18 +25534,31 @@
     "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17238,21 +25568,33 @@
     "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17260,21 +25602,32 @@
     "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -17282,21 +25635,32 @@
     "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -17304,16 +25668,30 @@
     "description": "A Dependabot rule's conditions, actions, or metadata changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17323,27 +25701,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -17352,23 +25736,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17376,10 +25770,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17390,20 +25802,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -17412,23 +25813,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17438,10 +25847,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17453,19 +25880,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -17476,10 +25893,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17488,21 +25923,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -17512,23 +25936,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -17537,22 +25973,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -17560,21 +26007,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -17582,25 +26040,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -17608,23 +26074,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -17638,24 +26117,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -17664,10 +26152,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17677,21 +26183,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -17701,25 +26197,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.19/user.json b/src/audit-logs/data/ghes-3.19/user.json
index f91931785d5f..d05abaa0f734 100644
--- a/src/audit-logs/data/ghes-3.19/user.json
+++ b/src/audit-logs/data/ghes-3.19/user.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,17 +67,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
-      "user_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -61,18 +98,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
+      "token_scopes",
       "user",
-      "request_id",
-      "_document_id",
-      "user_agent",
-      "actor",
       "user_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -80,18 +129,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "token_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -99,29 +160,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -129,18 +196,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -148,21 +227,34 @@
     "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -178,22 +270,34 @@
     "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "uuid",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -201,25 +305,37 @@
     "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
-      "request_access_security_header",
       "old_target_amount",
       "old_budget_limit_type",
       "old_alert_enabled",
@@ -233,17 +349,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -252,19 +381,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -273,15 +414,28 @@
     "description": "Azure subscription has been linked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -291,15 +445,28 @@
     "description": "Azure subscription has been unlinked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -309,18 +476,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -328,18 +508,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -347,15 +539,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -365,26 +570,36 @@
     "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -392,24 +607,34 @@
     "description": "A CSV export was requested on the \"Coverage\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -417,26 +642,36 @@
     "description": "A CSV export was requested on the \"Overview Dashboard\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -444,20 +679,31 @@
     "description": "A CSV export was requested on the \"Risk\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "user",
-      "user_id",
-      "query",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -468,17 +714,29 @@
     "description": "The cache retention policy for GitHub Actions was set for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -490,17 +748,29 @@
     "description": "The cache storage policy for GitHub Actions was set for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -512,17 +782,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -533,20 +816,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -555,19 +850,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -576,19 +884,31 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -597,20 +917,32 @@
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -619,19 +951,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -640,42 +984,64 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
   {
     "action": "checks.auto_trigger_enabled",
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -686,17 +1052,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -704,14 +1082,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -721,25 +1114,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -750,22 +1152,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -777,22 +1190,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -801,15 +1225,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -820,17 +1259,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -840,27 +1292,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "org",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -868,19 +1329,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -888,18 +1362,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -908,23 +1394,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -932,16 +1425,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -950,24 +1457,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -975,15 +1488,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -993,20 +1519,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1014,19 +1550,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -1034,21 +1582,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1056,22 +1613,33 @@
     "description": "Specific repositories were disabled from using Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "owner_type",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1079,21 +1647,31 @@
     "description": "Specific repositories were enabled to use Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "owner_type",
-      "owner",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1103,20 +1681,32 @@
     "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_access",
       "old_access",
-      "org_id",
       "owner_type",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1126,21 +1716,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1150,19 +1749,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1172,21 +1780,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1196,19 +1813,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1217,19 +1845,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1238,19 +1877,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1259,19 +1909,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1280,17 +1941,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1298,19 +1972,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1319,19 +2004,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1339,19 +2035,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1360,19 +2067,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1380,19 +2098,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1401,19 +2130,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1421,19 +2161,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1442,20 +2193,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1463,22 +2224,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1487,22 +2257,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1510,28 +2290,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1540,27 +2326,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1569,25 +2363,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1596,26 +2398,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1624,21 +2433,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1647,22 +2468,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1671,49 +2502,70 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "public_repo",
       "programmatic_access_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "Managing environments for deployment"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "visibility",
+      "operation_type",
+      "created_at",
+      "public_repo"
+    ],
+    "docs_reference_titles": "Managing environments for deployment"
   },
   {
     "action": "environment.update_actions_variable",
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1722,21 +2574,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -1747,21 +2609,32 @@
     "description": "A gist was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "gist_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "visibility",
-      "action",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ]
   },
   {
@@ -1769,20 +2642,32 @@
     "description": "A gist was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "gist_id",
-      "visibility",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "user",
-      "request_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "programmatic_access_type"
+      "gist_id",
+      "visibility",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1790,21 +2675,32 @@
     "description": "The visibility of a gist was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "user",
-      "gist_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "visibility",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "gist_id",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -1812,22 +2708,33 @@
     "description": "An SSH key was added to a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1836,23 +2743,34 @@
     "description": "An SSH key was removed from a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
       "explanation",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1861,23 +2779,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1885,18 +2812,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
-      "org",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1907,20 +2844,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1930,18 +2877,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "user",
-      "operation_type",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1949,18 +2908,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1968,25 +2939,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -1994,25 +2975,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -2020,26 +3010,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -2048,25 +3047,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -2074,26 +3082,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -2101,21 +3118,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -2124,19 +3152,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -2144,21 +3185,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -2167,19 +3219,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -2190,20 +3256,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2213,24 +3291,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2241,23 +3330,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2268,20 +3369,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2291,19 +3405,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -2312,20 +3440,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -2335,20 +3476,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -2357,20 +3511,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -2379,20 +3546,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2400,19 +3579,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2421,19 +3613,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2442,17 +3647,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2465,21 +3683,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -2493,17 +3724,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2515,20 +3759,30 @@
     "description": "An issue was marked as blocked by another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2539,19 +3793,30 @@
     "description": "The blocked by relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2561,20 +3826,30 @@
     "description": "An issue was marked as blocking another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2585,20 +3860,30 @@
     "description": "The blocking relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2609,18 +3894,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2628,21 +3925,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -2650,21 +3960,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2672,22 +3995,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -2695,19 +4031,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -2718,21 +4067,36 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
       "action",
-      "operation_type",
-      "marketplace_listing",
-      "has_free_trial",
-      "user_agent",
-      "request_id",
+      "actor",
       "actor_id",
-      "yearly_price_in_cents",
-      "description",
-      "bullets",
-      "monthly_price_in_cents",
-      "marketplace_listing_plan",
-      "_document_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "marketplace_listing",
+      "has_free_trial",
+      "yearly_price_in_cents",
+      "description",
+      "bullets",
+      "monthly_price_in_cents",
+      "marketplace_listing_plan"
     ]
   },
   {
@@ -2740,22 +4104,37 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "marketplace_listing_plan",
       "marketplace_listing",
       "description",
       "bullets",
       "has_free_trial",
       "created_at",
-      "actor_id",
       "operation_type",
-      "_document_id",
-      "action",
-      "user_agent",
-      "request_id",
-      "actor",
       "monthly_price_in_cents",
-      "yearly_price_in_cents",
-      "@timestamp"
+      "yearly_price_in_cents"
     ]
   },
   {
@@ -2763,21 +4142,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "marketplace_listing_plan",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "marketplace_listing_plan",
       "description",
       "yearly_price_in_cents",
-      "@timestamp",
       "created_at",
-      "actor_id",
       "bullets",
       "has_free_trial",
       "marketplace_listing",
-      "user_agent",
       "monthly_price_in_cents",
-      "action",
       "operation_type"
     ]
   },
@@ -2786,21 +4180,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "monthly_price_in_cents",
-      "marketplace_listing",
+      "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "monthly_price_in_cents",
+      "marketplace_listing",
       "description",
       "bullets",
       "yearly_price_in_cents",
-      "request_id",
-      "actor_id",
       "has_free_trial",
       "marketplace_listing_plan",
-      "user_agent",
-      "@timestamp",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -2809,22 +4218,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -2832,22 +4254,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2855,19 +4290,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2875,21 +4322,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2899,16 +4355,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2918,18 +4387,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "max_entries_to_build",
-      "min_entries_to_merge",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "max_entries_to_build",
+      "min_entries_to_merge",
+      "public_repo",
       "created_at",
       "operation_type"
     ]
@@ -2939,14 +4421,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2954,19 +4452,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -2974,18 +4483,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2993,23 +4514,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -3017,20 +4546,30 @@
     "description": "An OAuth access token was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
     "fields": [
-      "_document_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "user",
-      "user_id",
-      "created_at",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "request_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
@@ -3041,19 +4580,30 @@
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "explanation",
-      "hashed_token",
-      "actor_id",
-      "token_scopes",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
@@ -3063,19 +4613,30 @@
     "description": "An OAuth access token was regenerated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "_document_id",
-      "created_at",
       "@timestamp",
-      "operation_type",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ]
   },
@@ -3084,16 +4645,28 @@
     "description": "An OAuth access token was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "request_access_security_header",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
       "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3103,39 +4676,63 @@
     "description": "An OAuth access token was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
       "action",
-      "@timestamp",
-      "user",
-      "user_agent",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "oauth_application.create",
-    "description": "An OAuth application was created.",
-    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
-    "fields": [
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "oauth_application_id",
-      "operation_type",
-      "user_agent",
-      "actor_id",
       "org_id",
-      "action",
-      "actor",
-      "oauth_application",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "oauth_application.create",
+    "description": "An OAuth application was created.",
+    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+    "fields": [
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3144,20 +4741,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3166,20 +4775,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3188,20 +4809,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3210,19 +4843,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3231,20 +4877,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3253,20 +4911,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3275,19 +4945,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3296,24 +4979,31 @@
     "description": "An authorization for an OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "user_id",
-      "actor",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
       "actor_id",
-      "user",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "actor_is_bot",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -3323,20 +5013,31 @@
     "description": "An authorization for an OAuth application was deleted.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "actor",
       "created_at",
       "explanation",
-      "user",
-      "user_id",
-      "org_id",
-      "action",
-      "actor_id",
-      "token_scopes",
       "actor_is_bot",
       "oauth_application_name"
     ],
@@ -3347,20 +5048,31 @@
     "description": "An authorization for an OAuth application was updated.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
-      "actor_id",
       "user_agent",
-      "@timestamp",
       "operation_type",
-      "action",
-      "user",
       "created_at",
-      "_document_id",
       "actor_is_bot",
-      "request_access_security_header",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -3370,21 +5082,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -3393,24 +5115,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3418,20 +5150,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3439,22 +5181,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3462,20 +5212,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3483,22 +5243,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3506,21 +5274,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3528,26 +5305,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -3556,26 +5342,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3583,28 +5377,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3612,26 +5414,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3639,18 +5449,28 @@
     "description": "The cache retention policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3662,18 +5482,28 @@
     "description": "The cache storage policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3685,20 +5515,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -3707,16 +5548,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -3727,18 +5581,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -3747,18 +5614,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -3767,18 +5646,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -3787,18 +5679,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -3808,20 +5712,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -3829,17 +5744,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -3849,20 +5777,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -3871,20 +5810,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -3893,17 +5846,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3914,20 +5882,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -3936,19 +5918,31 @@
     "description": "A new passkey was added.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "user_agent",
+      "nickname",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3956,19 +5950,31 @@
     "description": "A new passkey was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3976,18 +5982,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3995,16 +6013,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4012,18 +6044,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4031,18 +6075,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4053,18 +6110,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4075,17 +6145,30 @@
     "description": "Triggered when you create a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4095,19 +6178,31 @@
     "description": "Triggered when you regenerate a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4115,12 +6210,29 @@
     "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
     "fields": [
-      "user_programmatic_access_name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
       "operation_type"
     ],
@@ -4131,38 +6243,63 @@
     "description": "Triggered when you delete a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
-      "user",
-      "user_id",
-      "explanation",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ]
-  },
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
+      "explanation",
+      "created_at",
+      "operation_type"
+    ]
+  },
   {
     "action": "personal_access_token.request_cancelled",
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -4173,18 +6310,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -4196,17 +6346,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -4218,17 +6381,30 @@
     "description": "A fine-grained personal access token was updated.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4239,15 +6415,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4257,17 +6448,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4277,15 +6479,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4295,17 +6512,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4315,17 +6543,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4335,17 +6574,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4355,17 +6605,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4375,17 +6636,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -4395,17 +6669,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4413,20 +6700,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -4436,25 +6734,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -4462,20 +6772,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4483,25 +6805,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4509,17 +6843,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4527,17 +6874,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4545,18 +6905,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -4565,18 +6937,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -4585,19 +6969,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -4605,17 +7000,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -4627,22 +7035,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -4650,19 +7067,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4670,17 +7098,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4688,18 +7129,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -4707,20 +7161,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4728,38 +7192,62 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
+  },
   {
     "action": "project_view.delete",
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -4768,16 +7256,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -4789,21 +7290,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -4811,18 +7324,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4833,23 +7359,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -4858,24 +7395,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -4884,20 +7432,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4906,21 +7468,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -4930,22 +7505,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "key",
-      "fingerprint",
-      "read_only",
-      "repo_id",
-      "operation_type",
-      "created_at",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "fingerprint",
+      "read_only",
+      "operation_type",
+      "created_at",
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4954,25 +7541,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4981,23 +7578,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -5006,22 +7614,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -5030,21 +7648,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -5053,25 +7680,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -5080,23 +7714,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -5105,24 +7747,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -5131,23 +7780,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -5157,22 +7814,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -5181,19 +7847,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -5202,24 +7881,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -5228,23 +7917,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -5255,17 +7953,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -5274,15 +7985,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -5293,16 +8017,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -5312,17 +8049,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -5332,19 +8082,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -5353,45 +8114,64 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
   {
     "action": "repo.configure_self_hosted_jit_runner",
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -5400,30 +8180,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -5433,20 +8218,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5455,25 +8251,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5482,23 +8286,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5506,25 +8321,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -5534,23 +8358,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -5558,21 +8392,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5580,21 +8424,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -5602,22 +8456,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5625,21 +8488,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -5647,20 +8520,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5668,22 +8552,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5691,18 +8584,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5710,22 +8617,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5733,21 +8650,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5755,42 +8682,63 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "Adding self-hosted runners"
-  },
-  {
-    "action": "repo.remove_actions_secret",
-    "description": "A GitHub Actions secret was deleted for a repository.",
-    "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Adding self-hosted runners"
+  },
+  {
+    "action": "repo.remove_actions_secret",
+    "description": "A GitHub Actions secret was deleted for a repository.",
+    "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
+    "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5799,24 +8747,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5825,23 +8781,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5849,26 +8815,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -5877,21 +8848,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -5900,25 +8880,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5926,22 +8912,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -5950,42 +8946,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
-    ]
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "repo.set_actions_cache_retention_policy",
     "description": "The cache retention policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5997,22 +9012,30 @@
     "description": "The cache storage policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -6024,23 +9047,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -6050,20 +9082,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -6074,21 +9117,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -6097,22 +9151,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -6121,21 +9185,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -6144,22 +9219,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -6170,16 +9255,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -6188,22 +9284,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -6213,22 +9318,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -6237,23 +9353,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -6263,19 +9389,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -6283,21 +9419,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -6306,24 +9452,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -6331,25 +9486,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -6358,24 +9520,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6384,25 +9556,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -6411,22 +9591,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6435,26 +9624,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -6462,31 +9659,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6495,21 +9699,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -6517,21 +9731,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6539,21 +9763,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -6561,20 +9796,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6582,21 +9829,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6604,51 +9862,72 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
-      "actor_id",
-      "operation_type",
-      "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
-    ]
-  },
-  {
-    "action": "repository_ruleset.create",
-    "description": "A repository ruleset was created.",
-    "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
-    "fields": [
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
+      "created_at",
+      "inviter"
+    ]
+  },
+  {
+    "action": "repository_ruleset.create",
+    "description": "A repository ruleset was created.",
+    "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "public_repo",
+      "created_at",
+      "operation_type",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -6657,19 +9936,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -6677,8 +9967,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -6687,23 +9976,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -6728,18 +10026,30 @@
     "description": "A security key was registered for an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6747,18 +10057,30 @@
     "description": "A security key was removed from an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6766,14 +10088,28 @@
     "description": "A user linked a social identity to their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6783,14 +10119,28 @@
     "description": "A user unlinked a social identity from their account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6800,15 +10150,28 @@
     "description": "A user unlinked all social identities from their account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6818,16 +10181,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6837,18 +10213,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -6857,16 +10246,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6877,15 +10279,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -6895,15 +10310,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -6912,17 +10342,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -6931,17 +10374,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -6950,16 +10407,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -6969,14 +10439,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -6986,17 +10471,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -7005,17 +10503,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -7024,18 +10535,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7044,15 +10568,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -7062,16 +10600,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7079,15 +10630,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -7098,16 +10662,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -7117,17 +10694,30 @@
     "description": "Triggered when you send an email update to your sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
     "fields": [
-      "request_id",
-      "actor",
-      "action",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
   },
@@ -7136,17 +10726,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -7157,17 +10760,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -7178,18 +10794,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -7199,16 +10826,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -7218,17 +10858,30 @@
     "description": "You join the waitlist to join GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
-      "user_agent",
       "actor_id",
-      "action",
-      "operation_type",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -7237,16 +10890,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -7256,23 +10922,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7280,23 +10956,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7304,23 +10990,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7328,23 +11024,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7352,15 +11058,30 @@
     "description": "Triggered when you accept a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7369,15 +11090,30 @@
     "description": "Triggered when you cancel a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7386,15 +11122,30 @@
     "description": "Triggered when you create a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7403,32 +11154,62 @@
     "description": "Triggered when you decline a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
-  },
-  {
-    "action": "successor_invitation.destroy",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
+  },
+  {
+    "action": "successor_invitation.destroy",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7436,15 +11217,30 @@
     "description": "Triggered when you revoke a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7453,17 +11249,30 @@
     "description": "A new trusted device was added.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7471,17 +11280,30 @@
     "description": "A trusted device was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7489,14 +11311,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "action",
-      "request_id",
-      "user_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -7505,15 +11342,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "created_at",
-      "user_id",
-      "operation_type",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7521,13 +11373,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "created_at",
-      "user_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7535,17 +11404,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "operation_type",
-      "action",
-      "_document_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7553,17 +11435,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7571,16 +11466,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "created_at",
-      "user_id",
-      "action",
       "_document_id",
-      "request_access_security_header"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7588,15 +11497,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "user",
       "_document_id",
-      "request_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7604,18 +11528,30 @@
     "description": "A secondary authentication factor was added to a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -7624,18 +11560,30 @@
     "description": "Two-factor authentication was disabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
     "fields": [
-      "actor",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_id",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Disabling two-factor authentication for your personal account"
   },
@@ -7644,18 +11592,30 @@
     "description": "Two-factor authentication was enabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
-      "actor",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Configuring two-factor authentication"
   },
@@ -7664,15 +11624,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user",
-      "user_id",
-      "action",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "user_agent"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7680,16 +11655,29 @@
     "description": "Two factor recovery codes were regenerated for a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
+      "operation_type",
       "created_at"
     ]
   },
@@ -7698,18 +11686,30 @@
     "description": "A secondary authentication factor was removed from a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -7718,15 +11718,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "created_at",
-      "_document_id",
-      "action",
-      "@timestamp"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7735,16 +11750,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "operation_type",
       "user_agent",
-      "action",
-      "request_id",
-      "actor",
-      "actor_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7752,19 +11780,31 @@
     "description": "An email address was added to a user account.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "actor_id",
-      "actor",
       "email",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding an email address to your GitHub account"
   },
@@ -7773,18 +11813,30 @@
     "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "created_at",
-      "user",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7792,15 +11844,28 @@
     "description": "Audit log entries were exported.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "action",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ]
@@ -7810,20 +11875,31 @@
     "description": "A user was blocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_id",
-      "_document_id",
       "actor_id",
-      "@timestamp",
-      "user_agent",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7831,18 +11907,30 @@
     "description": "A user changed their password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "actor_id",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7850,18 +11938,30 @@
     "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -7870,17 +11970,30 @@
     "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -7889,19 +12002,31 @@
     "description": "A new user account was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "email",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "created_at",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "programmatic_access_type"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "email",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7909,21 +12034,33 @@
     "description": "A user secret for Codespaces was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7931,39 +12068,62 @@
     "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "oauth_application_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "@timestamp",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
-  {
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
+    ]
+  },
+  {
     "action": "user.delete",
     "description": "A user account was destroyed by an asynchronous job.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7972,19 +12132,30 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "oauth_application_id",
+      "_document_id",
       "action",
-      "user",
-      "created_at",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7992,18 +12163,30 @@
     "description": "A user deleted his or her account, triggering user.async_delete.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
-      "created_at",
-      "user_agent",
       "user_id",
-      "operation_type",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8011,18 +12194,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "user_agent",
       "user_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8030,18 +12225,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "_document_id",
-      "@timestamp",
-      "user",
-      "actor_id",
-      "action",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8050,17 +12257,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "request_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8068,17 +12287,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8086,17 +12318,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8104,17 +12349,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8122,21 +12380,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -8144,21 +12412,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -8167,17 +12445,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8185,17 +12476,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8203,17 +12507,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8221,18 +12538,30 @@
     "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "org_id",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8240,17 +12569,31 @@
     "description": "A user requested a password reset.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
     "fields": [
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "email",
-      "created_at",
-      "user_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
   },
@@ -8259,17 +12602,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "created_at",
-      "user_agent",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "request_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8277,18 +12633,30 @@
     "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -8297,19 +12665,31 @@
     "description": "A user signed in.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "actor_id",
       "@timestamp",
-      "user",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "actor",
-      "passkey_nickname",
-      "request_access_security_header"
+      "passkey_nickname"
     ]
   },
   {
@@ -8317,18 +12697,30 @@
     "description": "A user signed out.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8336,18 +12728,30 @@
     "description": "A user signed in from a new device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8355,21 +12759,31 @@
     "description": "An ordinary user account was promoted to a site administrator.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
+      "user_id",
       "user_agent",
+      "created_at",
       "oauth_application_id",
-      "request_id",
-      "operation_type",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8377,16 +12791,29 @@
     "description": "A user's account was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user",
-      "action",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "operation_type"
     ]
   },
@@ -8395,20 +12822,31 @@
     "description": "An email address was removed from a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "actor_id",
       "created_at",
-      "email",
-      "token_scopes",
-      "programmatic_access_type"
+      "email"
     ]
   },
   {
@@ -8416,20 +12854,32 @@
     "description": "A user secret for Codespaces was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "key",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8437,20 +12887,31 @@
     "description": "A username was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "request_id",
-      "actor_id",
-      "old_login",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_login",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8458,18 +12919,30 @@
     "description": "A user reset their account password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8477,16 +12950,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -8497,16 +12983,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -8515,18 +13013,30 @@
     "description": "A user signed in from an unrecognized device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor",
-      "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8534,18 +13044,30 @@
     "description": "A user signed in from an unrecognized device and location.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "created_at",
-      "_document_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8553,22 +13075,33 @@
     "description": "Triggered when you clear the status on your profile.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "message",
-      "user",
-      "actor_id",
       "created_at",
-      "request_id",
       "limited_availability",
-      "action",
       "emoji",
-      "operation_type",
-      "user_agent",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8576,23 +13109,33 @@
     "description": "Triggered when you set or change the status on your profile.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
     "fields": [
-      "limited_availability",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "message",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "limited_availability",
+      "message",
+      "created_at",
       "emoji",
-      "org",
-      "actor",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
   },
@@ -8601,21 +13144,31 @@
     "description": "A user account was suspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "user_agent",
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "token_scopes",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8623,18 +13176,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
-      "actor_id",
       "@timestamp",
-      "operation_type",
       "_document_id",
-      "user_agent",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8642,18 +13207,30 @@
     "description": "A 2FA challenge issued for a user account failed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "actor_id",
-      "actor",
-      "user_id",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8663,16 +13240,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
       "user_agent",
-      "request_id",
-      "action",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8680,18 +13269,30 @@
     "description": "A user used their 2FA recovery codes.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8699,18 +13300,30 @@
     "description": "A user downloaded 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8718,17 +13331,30 @@
     "description": "A user printed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8736,18 +13362,30 @@
     "description": "A user viewed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
       "created_at",
-      "user",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8755,17 +13393,30 @@
     "description": "A user was prompted for a two-factor authentication code.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
     "fields": [
-      "user",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "actor"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
   },
@@ -8774,19 +13425,31 @@
     "description": "A user was unblocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "user_agent",
-      "user_id",
-      "user",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8794,21 +13457,31 @@
     "description": "A user account was unsuspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "user_agent",
       "actor",
-      "oauth_application_id",
-      "operation_type",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "user_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8816,21 +13489,33 @@
     "description": "A user secret for Codespaces was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8838,46 +13523,64 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "workflows.approve_workflow_job",
+    "description": "A workflow job was approved.",
+    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "workflows.approve_workflow_job",
-    "description": "A workflow job was approved.",
-    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
-    "fields": [
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "workflow_run_id",
       "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -8886,23 +13589,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8910,23 +13623,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8936,23 +13657,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -8961,22 +13694,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8984,21 +13728,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -9006,25 +13761,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9032,24 +13795,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -9058,25 +13830,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.20/enterprise.json b/src/audit-logs/data/ghes-3.20/enterprise.json
index 77205f9f3c9f..1bdd61afc71d 100644
--- a/src/audit-logs/data/ghes-3.20/enterprise.json
+++ b/src/audit-logs/data/ghes-3.20/enterprise.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,17 +67,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
-      "user_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -61,18 +98,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
+      "token_scopes",
       "user",
-      "request_id",
-      "_document_id",
-      "user_agent",
-      "actor",
       "user_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -80,18 +129,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "token_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -99,29 +160,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -129,31 +196,34 @@
     "description": "An API request was made to an endpoint for the enterprise, or an enterprise owned resource. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is only available via audit log streaming.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "query_string",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "request_body",
-      "status_code",
-      "url_path",
       "business",
       "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "request_method",
+      "query_string",
+      "request_body",
+      "status_code",
+      "url_path",
+      "public_repo",
       "created_at",
       "operation_type",
       "route",
@@ -167,18 +237,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -186,20 +268,32 @@
     "description": "A manual check of the endpoint configured for audit log streaming was performed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "audit_log_stream_result",
-      "business_id",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_result",
       "created_at",
       "operation_type",
-      "audit_log_stream_sink_details",
-      "request_access_security_header"
+      "audit_log_stream_sink_details"
     ]
   },
   {
@@ -207,18 +301,31 @@
     "description": "An endpoint was added for audit log streaming.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "business_id",
       "business",
-      "audit_log_stream_sink",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_sink",
+      "created_at",
+      "operation_type",
       "audit_log_stream_id"
     ]
   },
@@ -227,15 +334,28 @@
     "description": "An audit log streaming endpoint was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "business_id",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "audit_log_stream_id",
@@ -247,17 +367,30 @@
     "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "audit_log_stream_enabled",
-      "business_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "audit_log_stream_enabled",
       "audit_log_stream_sink",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "new_s3_bucket",
@@ -280,21 +413,34 @@
     "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -310,22 +456,34 @@
     "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "uuid",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -333,25 +491,37 @@
     "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
-      "request_access_security_header",
       "old_target_amount",
       "old_budget_limit_type",
       "old_alert_enabled",
@@ -365,17 +535,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -384,19 +567,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -405,15 +600,28 @@
     "description": "Azure subscription has been linked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -423,15 +631,28 @@
     "description": "Azure subscription has been unlinked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -441,18 +662,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
-      "user",
-      "user_id",
-      "user_agent",
-      "created_at",
-      "action"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -460,16 +694,28 @@
     "description": "The premium request paid usage policy for your GitHub account was changed.",
     "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -481,18 +727,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -500,15 +758,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -518,22 +789,31 @@
     "description": "An enterprise owner was added to an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
     "fields": [
-      "name",
-      "business",
-      "user",
-      "user_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "request_id",
+      "business",
       "business_id",
-      "_document_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Inviting people to manage your enterprise"
   },
@@ -542,22 +822,32 @@
     "description": "An organization was added to an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "operation_type",
       "name",
       "created_at",
-      "request_id",
-      "_document_id",
-      "business",
-      "organization_upgrade",
-      "request_access_security_header"
+      "organization_upgrade"
     ]
   },
   {
@@ -565,20 +855,30 @@
     "description": "GitHub Advanced Security was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -587,17 +887,28 @@
     "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -608,21 +919,31 @@
     "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -631,17 +952,28 @@
     "description": "GitHub Advanced Security was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -652,17 +984,28 @@
     "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -673,21 +1016,31 @@
     "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -696,20 +1049,32 @@
     "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "new_policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "new_policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -718,20 +1083,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -739,17 +1116,28 @@
     "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -761,21 +1149,31 @@
     "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -784,18 +1182,31 @@
     "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -804,17 +1215,30 @@
     "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
     "fields": [
-      "name",
-      "operation_type",
-      "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "actor",
+      "@timestamp",
       "_document_id",
-      "business",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -824,19 +1248,32 @@
     "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
-      "action",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "business",
       "visibility",
       "created_at",
-      "actor",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -845,21 +1282,33 @@
     "description": "The policy for Code scanning autofix was updated for an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -867,21 +1316,33 @@
     "description": "The policy for Code scanning autofix third party tools was updated for an enterprise.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/getting-started/github-security-features#available-with-github-code-security"
   },
@@ -890,18 +1351,30 @@
     "description": "The policy for Code Security enablement was updated for an enterprise.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#available-with-github-code-security",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -913,19 +1386,31 @@
     "description": "An enterprise was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "request_id",
-      "name",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "operation_type",
-      "actor",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -933,17 +1418,28 @@
     "description": "Dependabot alerts were disabled for new repositories in your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -953,17 +1449,28 @@
     "description": "Dependabot alerts were enabled for new repositories in your enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -973,17 +1480,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -993,18 +1513,30 @@
     "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1012,17 +1544,28 @@
     "description": "Display of IP addresses within audit log events for the enterprise was disabled.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1033,18 +1576,31 @@
     "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "business_id",
-      "actor_id",
-      "name",
-      "_document_id",
-      "request_id"
+      "name"
     ]
   },
   {
@@ -1052,15 +1608,28 @@
     "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1070,17 +1639,28 @@
     "description": "Display of IP addresses within audit log events for the enterprise was enabled.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1091,18 +1671,31 @@
     "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "operation_type",
-      "created_at",
+      "actor_id",
       "business",
       "business_id",
-      "name",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ]
   },
   {
@@ -1110,20 +1703,31 @@
     "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
       "business",
-      "name",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "business_id",
-      "_document_id"
+      "created_at",
+      "name",
+      "operation_type"
     ]
   },
   {
@@ -1131,20 +1735,31 @@
     "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1152,20 +1767,31 @@
     "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "business",
-      "actor_id",
-      "created_at",
-      "action",
+      "user_id",
       "user_agent",
-      "request_id",
-      "user_id"
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1173,20 +1799,31 @@
     "description": "An enterprise owner was removed from an enterprise.",
     "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
-      "user_agent",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "name",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
-      "user"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "name"
     ],
     "docs_reference_titles": "Inviting people to manage your enterprise"
   },
@@ -1195,20 +1832,31 @@
     "description": "An organization was removed from an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "business",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "business_id",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "name",
-      "org"
+      "name"
     ]
   },
   {
@@ -1216,18 +1864,31 @@
     "description": "The slug for the enterprise URL was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "name",
-      "business_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
-      "@timestamp",
-      "created_at",
+      "actor_id",
       "business",
-      "_document_id"
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1235,20 +1896,31 @@
     "description": "The SAML single sign-on session for a member in an enterprise was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "_document_id",
-      "actor_id",
       "name",
-      "@timestamp",
-      "user_id",
-      "action",
-      "created_at",
-      "business"
+      "created_at"
     ]
   },
   {
@@ -1256,17 +1928,28 @@
     "description": "Automatic partner validation checks have been disabled at the business level",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1277,17 +1960,28 @@
     "description": "Automatic partner validation checks have been enabled at the business level",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1298,20 +1992,30 @@
     "description": "An enterprise-level custom pattern was created for secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -1320,17 +2024,28 @@
     "description": "An enterprise-level custom pattern was removed from secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1340,20 +2055,30 @@
     "description": "An enterprise-level custom pattern was published for secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1361,17 +2086,28 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1382,20 +2118,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -1404,17 +2150,28 @@
     "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1424,17 +2181,28 @@
     "description": "Secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1445,17 +2213,28 @@
     "description": "Secret scanning was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1466,17 +2245,28 @@
     "description": "Secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1487,19 +2277,30 @@
     "description": "Secret scanning was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
   },
@@ -1508,17 +2309,28 @@
     "description": "Secret scanning for non-provider patterns was disabled at the enterprise level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1530,17 +2342,28 @@
     "description": "Secret scanning for non-provider patterns was enabled at the enterprise level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1552,17 +2375,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1573,17 +2407,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1594,17 +2439,28 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1615,17 +2471,28 @@
     "description": "Push protection for secret scanning was disabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1636,17 +2503,28 @@
     "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1657,17 +2535,28 @@
     "description": "Push protection for secret scanning was enabled for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1678,17 +2567,28 @@
     "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -1699,10 +2599,28 @@
     "description": "The push protection setting was updated for a secret type for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "push_protection_setting",
       "secret_type",
       "secret_type_display_name",
@@ -1715,33 +2633,63 @@
     "description": "The push protection pattern configuration was updated for your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
       "business_id",
-      "created_at"
-    ],
-    "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
-  },
-  {
-    "action": "business.secret_scanning_repo_admin_settings_policy_update",
-    "description": "N/A",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at"
+    ],
+    "docs_reference_titles": "Managing GitHub Advanced Security features for your enterprise"
+  },
+  {
+    "action": "business.secret_scanning_repo_admin_settings_policy_update",
+    "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "new_policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1749,26 +2697,36 @@
     "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1776,24 +2734,34 @@
     "description": "A CSV export was requested on the \"Coverage\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1801,26 +2769,36 @@
     "description": "A CSV export was requested on the \"Overview Dashboard\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1828,20 +2806,31 @@
     "description": "A CSV export was requested on the \"Risk\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1852,17 +2841,29 @@
     "description": "The cache retention policy for GitHub Actions was set for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1874,17 +2875,29 @@
     "description": "The cache storage policy for GitHub Actions was set for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1896,17 +2909,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -1917,20 +2943,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1939,19 +2977,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "limit",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1960,19 +3011,31 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -1981,20 +3044,32 @@
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -2003,19 +3078,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -2024,20 +3111,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "issuer",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
       "business",
       "business_id",
-      "actor_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "issuer",
+      "name",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -2045,18 +3144,31 @@
     "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "updated_github_owned_allowed",
       "updated_verified_allowed",
       "updated_patterns",
@@ -2071,20 +3183,33 @@
     "description": "The base repository permission setting was updated for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions",
     "fields": [
-      "business_id",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "permission",
-      "action",
       "created_at",
-      "@timestamp",
-      "request_id",
       "name",
-      "_document_id",
-      "old_permission",
-      "business"
+      "old_permission"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -2093,19 +3218,32 @@
     "description": "The repository creation setting was updated for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "name",
-      "business_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "operation_type",
-      "permission",
-      "action",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "name",
+      "operation_type",
+      "permission",
       "visibility"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -2115,19 +3253,32 @@
     "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories",
     "fields": [
-      "business_id",
-      "created_at",
-      "action",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "permission",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "business"
+      "created_at",
+      "operation_type",
+      "permission",
+      "name"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -2136,42 +3287,64 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
-      "repo_id",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
-  },
-  {
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
+  },
+  {
     "action": "checks.auto_trigger_enabled",
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -2182,17 +3355,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2200,15 +3385,31 @@
     "description": "Existing code scanning alerts appeared in a branch.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2218,15 +3419,31 @@
     "description": "Code scanning alerts were fixed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2236,15 +3453,31 @@
     "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_numbers",
       "commit_oid",
-      "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business"
+      "ref"
     ],
     "docs_reference_titles": "About code scanning"
   },
@@ -2253,15 +3486,29 @@
     "description": "Code scanning alerts were manually dismissed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers",
       "dismissal_approver_id"
     ],
@@ -2272,19 +3519,31 @@
     "description": "Dismissal of code scanning alerts was approved.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2295,19 +3554,31 @@
     "description": "Dismissal of code scanning alerts was denied.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2318,19 +3589,31 @@
     "description": "Dismissal of code scanning alerts was requested.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2341,13 +3624,31 @@
     "description": "Code scanning alerts were seen for the first time.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2357,15 +3658,31 @@
     "description": "Code scanning alerts that were previously fixed reappeared.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2375,15 +3692,29 @@
     "description": "Code scanning alerts that were previously dismissed were reopened.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -2393,14 +3724,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2410,25 +3756,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -2439,22 +3794,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -2466,22 +3832,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -2490,15 +3867,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -2509,17 +3901,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2529,27 +3934,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "owner",
-      "pull_request_id",
-      "machine_type",
-      "user_id",
-      "user",
-      "devcontainer_path",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
+      "machine_type",
+      "devcontainer_path",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2557,19 +3971,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -2577,18 +4004,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -2597,23 +4036,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2621,16 +4067,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -2639,24 +4099,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2664,15 +4130,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2682,20 +4161,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2703,19 +4192,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -2723,21 +4224,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -2745,22 +4255,33 @@
     "description": "Specific repositories were disabled from using Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "owner_type",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -2768,21 +4289,31 @@
     "description": "Specific repositories were enabled to use Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "owner_type",
-      "owner",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2792,20 +4323,32 @@
     "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_access",
       "old_access",
-      "org_id",
       "owner_type",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2815,21 +4358,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2839,19 +4391,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -2861,21 +4422,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2885,18 +4455,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -2909,18 +4492,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -2934,14 +4530,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -2954,8 +4565,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2964,27 +4574,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "definition_id",
-      "property_name",
-      "value",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "definition_id",
+      "property_name",
+      "value",
+      "public_repo",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -2993,19 +4611,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -3014,16 +4644,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "definition_id"
@@ -3035,19 +4678,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -3056,19 +4710,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -3077,19 +4742,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -3098,19 +4774,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -3119,21 +4806,31 @@
     "description": "The default repository access for Dependabot was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "access_level",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -3142,17 +4839,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3160,40 +4870,62 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
-  },
-  {
-    "action": "dependabot_security_updates.enable",
-    "description": "Dependabot security updates were enabled for all existing repositories.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
+      "user_agent",
       "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+  },
+  {
+    "action": "dependabot_security_updates.enable",
+    "description": "Dependabot security updates were enabled for all existing repositories.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
-      "_document_id"
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3201,19 +4933,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -3222,19 +4965,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3242,19 +4996,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -3263,19 +5028,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3283,19 +5059,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -3304,20 +5091,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3325,21 +5122,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "team",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "number",
-      "org",
-      "title",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id"
+      "team",
+      "created_at",
+      "number",
+      "title",
+      "operation_type"
     ]
   },
   {
@@ -3347,18 +5156,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
-      "user_agent",
-      "operation_type",
-      "user_id",
+      "_document_id",
+      "action",
       "actor",
-      "number",
-      "user",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "number",
+      "created_at"
     ]
   },
   {
@@ -3366,18 +5188,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "_document_id",
-      "request_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "number",
       "team",
       "created_at"
@@ -3388,21 +5221,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "_document_id",
-      "title",
-      "user",
-      "user_agent",
-      "org",
-      "operation_type",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "team",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type",
+      "team",
       "number"
     ]
   },
@@ -3411,17 +5255,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3432,16 +5290,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3452,18 +5324,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
       "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -3474,23 +5360,31 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-enterprise"
   },
@@ -3499,19 +5393,33 @@
     "description": "A domain was approved for an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3520,18 +5428,33 @@
     "description": "A domain was added to an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3540,18 +5463,33 @@
     "description": "A domain was removed from an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3560,18 +5498,33 @@
     "description": "A domain was verified for an enterprise.",
     "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Verifying or approving a domain for your enterprise"
   },
@@ -3580,18 +5533,30 @@
     "description": "A new GitHub Actions self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -3600,20 +5565,30 @@
     "description": "A GitHub Actions self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -3622,20 +5597,30 @@
     "description": "An enterprise role was assigned to a user or enterprise team.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "enterprise_role_id",
-      "enterprise_role_name",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "enterprise_role_id",
+      "enterprise_role_name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3647,20 +5632,32 @@
     "description": "A custom enterprise role was created in an enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3672,20 +5669,32 @@
     "description": "A custom enterprise role was deleted in an enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3697,20 +5706,30 @@
     "description": "A user or enterprise team was unassigned an enterprise role.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "enterprise_role_id",
-      "enterprise_role_name",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "enterprise_role_id",
+      "enterprise_role_name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3722,21 +5741,33 @@
     "description": "A custom enterprise role was edited in an enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/roles-in-an-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
       "old_role_permissions",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3748,18 +5779,31 @@
     "description": "A GitHub Actions self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
@@ -3769,40 +5813,66 @@
     "description": "A GitHub Actions self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "Managing access to self-hosted runners using groups"
-  },
-  {
-    "action": "enterprise.runner_group_runner_removed",
-    "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.",
-    "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Managing access to self-hosted runners using groups"
+  },
+  {
+    "action": "enterprise.runner_group_runner_removed",
+    "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.",
+    "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -3811,19 +5881,31 @@
     "description": "A GitHub Actions self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3832,19 +5914,32 @@
     "description": "A GitHub Actions runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -3853,24 +5948,36 @@
     "description": "The configuration of a GitHub Actions self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -3879,14 +5986,32 @@
     "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -3895,14 +6020,32 @@
     "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -3911,18 +6054,36 @@
     "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
       "target_version",
       "runner_group_id",
       "runner_group_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Self-hosted runners"
   },
@@ -3931,22 +6092,32 @@
     "description": "A new member was added to the enterprise team or an IdP group linked to an enterprise team, or an IdP group was linked to an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "business_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "user",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3954,39 +6125,64 @@
     "description": "A license for GitHub Copilot was assigned to an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "business_id",
-      "enterprise_team_id",
-      "enterprise_team",
       "business",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "enterprise_team.copilot_unassignment",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "enterprise_team_id",
+      "enterprise_team",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
+    ]
+  },
+  {
+    "action": "enterprise_team.copilot_unassignment",
     "description": "A license for GitHub Copilot was unassigned from an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3997,17 +6193,30 @@
     "description": "A new enterprise team was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4017,17 +6226,30 @@
     "description": "An enterprise team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4038,22 +6260,32 @@
     "description": "A member was removed from the enterprise team or an IdP group linked to an enterprise team, or an IdP group was unlinked from an enterprise team.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "business_id",
+      "user_agent",
       "enterprise_team_id",
       "enterprise_team",
-      "user",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4061,18 +6293,31 @@
     "description": "The name of an enterprise team was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "business_id",
       "enterprise_team_id",
       "enterprise_team",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4083,22 +6328,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -4107,22 +6361,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4130,28 +6394,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -4160,27 +6430,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
-      "visibility",
-      "environment_name",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "visibility",
+      "environment_name",
+      "public_repo",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -4189,25 +6467,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -4216,26 +6502,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -4244,21 +6537,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -4267,22 +6572,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -4291,25 +6606,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -4318,22 +6642,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -4342,21 +6678,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -4367,27 +6713,33 @@
     "description": "A user was added to an external group.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "external_group",
-      "external_group_id",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "external_group",
+      "external_group_id",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -4395,19 +6747,31 @@
     "description": "An external group was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at",
       "scim_group_id"
     ]
   },
@@ -4416,22 +6780,33 @@
     "description": "An external group was linked to a GitHub team.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "external_group",
-      "programmatic_access_type",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -4439,21 +6814,31 @@
     "description": "An external group was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4461,26 +6846,32 @@
     "description": "A user was removed from an external group.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "external_group",
-      "external_group_id",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "external_group",
+      "external_group_id",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4488,15 +6879,29 @@
     "description": "Failed external group SCIM API request.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
@@ -4504,15 +6909,9 @@
       "url_path",
       "scim_group_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4521,30 +6920,38 @@
     "description": "Successful external group SCIM API request. Excludes GET API requests.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4553,18 +6960,31 @@
     "description": "An external group was unlinked to a GitHub team.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "external_group_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "external_group"
     ]
   },
@@ -4573,22 +6993,32 @@
     "description": "An external group was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "scim_group_id",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at",
+      "scim_group_id"
     ]
   },
   {
@@ -4596,25 +7026,33 @@
     "description": "An external group's display name was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
-      "external_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "external_group_id",
       "external_group",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "scim_group_id",
-      "request_access_security_header"
+      "scim_group_id"
     ]
   },
   {
@@ -4622,20 +7060,31 @@
     "description": "An external identity was deprovisioned, suspending the linked GitHub user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -4643,17 +7092,31 @@
     "description": "An external identity was created and linked to a GitHub user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "scim_user_id",
-      "request_access_security_header"
+      "scim_user_id"
     ]
   },
   {
@@ -4661,15 +7124,29 @@
     "description": "Failed external identity SCIM API request.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
@@ -4677,15 +7154,9 @@
       "url_path",
       "scim_user_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4694,30 +7165,38 @@
     "description": "Successful external identity SCIM API request. Excludes GET API requests.",
     "docs_reference_links": "/rest/scim/scim",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_method",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "request_method",
       "query_string",
       "api_request_body",
       "route",
       "status_code",
       "url_path",
       "scim_user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "REST API endpoints for SCIM"
   },
@@ -4726,18 +7205,31 @@
     "description": "An external identity was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "scim_user_id",
-      "request_access_security_header"
+      "scim_user_id"
     ]
   },
   {
@@ -4745,21 +7237,32 @@
     "description": "A gist was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "gist_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "visibility",
-      "action",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ]
   },
   {
@@ -4767,20 +7270,32 @@
     "description": "A gist was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "gist_id",
-      "visibility",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "user",
-      "request_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "programmatic_access_type"
+      "gist_id",
+      "visibility",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4788,41 +7303,63 @@
     "description": "The visibility of a gist was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "user",
-      "gist_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "visibility",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "gist_id",
+      "visibility",
+      "created_at"
+    ]
+  },
   {
     "action": "git.clone",
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4831,20 +7368,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4853,19 +7400,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -4874,22 +7432,33 @@
     "description": "An SSH key was added to a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -4898,23 +7467,34 @@
     "description": "An SSH key was removed from a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
       "explanation",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -4923,23 +7503,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4947,18 +7536,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4969,20 +7568,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -4992,18 +7601,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "user",
-      "operation_type",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5011,18 +7632,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "action",
-      "created_at",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5030,25 +7663,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -5056,25 +7699,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -5082,26 +7734,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -5110,25 +7771,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -5136,26 +7806,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -5163,21 +7842,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -5186,19 +7876,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -5206,42 +7909,67 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "application_client_id"
-    ]
-  },
-  {
-    "action": "integration_installation.create",
-    "description": "A GitHub App was installed.",
-    "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
-    "fields": [
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
+      "created_at",
+      "application_client_id"
+    ]
+  },
+  {
+    "action": "integration_installation.create",
+    "description": "A GitHub App was installed.",
+    "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
+    "fields": [
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -5252,20 +7980,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -5275,24 +8015,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -5303,23 +8054,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -5330,21 +8093,33 @@
     "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
       "operation_type",
-      "@timestamp",
       "integration",
-      "action",
-      "user_agent",
       "reason",
-      "_document_id",
-      "org",
-      "org_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -5355,20 +8130,32 @@
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
       "@timestamp",
-      "actor_id",
-      "org",
       "_document_id",
-      "requester",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "requester",
       "created_at",
       "url",
-      "org_id",
-      "request_id",
       "operation_type",
-      "actor",
       "integration",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -5378,20 +8165,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -5401,19 +8201,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -5422,20 +8236,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
-      "user_id",
-      "user_agent",
-      "name",
-      "user",
-      "operation_type",
-      "actor_id",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "integration",
+      "name",
+      "operation_type",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -5445,20 +8272,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -5467,20 +8307,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -5489,20 +8342,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5510,19 +8375,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -5531,19 +8409,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -5552,17 +8443,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -5575,21 +8479,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -5603,17 +8520,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -5625,39 +8555,61 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "actor_id",
-      "created_at",
-      "org_id",
       "action",
-      "@timestamp",
-      "user"
-    ]
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "ip_allow_list.disable_for_installed_apps",
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5665,17 +8617,28 @@
     "description": "IP allow list user level enforcement was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5685,20 +8648,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "user_id",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
-      "_document_id",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "actor_id",
       "operation_type",
-      "org",
       "created_at"
     ]
   },
@@ -5707,19 +8679,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5727,17 +8710,28 @@
     "description": "IP allow list user level enforcement was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5747,24 +8741,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5772,24 +8774,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "ip_allow_list_entry",
-      "org",
-      "operation_type",
-      "created_at",
-      "active",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at",
+      "active"
     ]
   },
   {
@@ -5797,19 +8807,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "actor_id",
       "ip_allow_list_entry",
-      "active",
-      "org_id",
-      "@timestamp"
+      "active"
     ]
   },
   {
@@ -5817,21 +8840,31 @@
     "description": "An issue was marked as blocked by another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
+      "public_repo",
+      "created_at",
       "operation_type",
       "actor_is_bot"
     ]
@@ -5841,19 +8874,30 @@
     "description": "The blocked by relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5863,20 +8907,30 @@
     "description": "An issue was marked as blocking another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5887,20 +8941,30 @@
     "description": "The blocking relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5911,18 +8975,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5930,21 +9006,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -5952,21 +9041,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5974,22 +9076,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -5997,19 +9112,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -6020,44 +9148,74 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
       "action",
-      "operation_type",
-      "marketplace_listing",
-      "has_free_trial",
-      "user_agent",
-      "request_id",
+      "actor",
       "actor_id",
-      "yearly_price_in_cents",
-      "description",
-      "bullets",
-      "monthly_price_in_cents",
-      "marketplace_listing_plan",
-      "_document_id"
-    ]
-  },
-  {
-    "action": "marketplace_listing_plan.publish",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "marketplace_listing",
+      "has_free_trial",
+      "yearly_price_in_cents",
+      "description",
+      "bullets",
+      "monthly_price_in_cents",
+      "marketplace_listing_plan"
+    ]
+  },
+  {
+    "action": "marketplace_listing_plan.publish",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "marketplace_listing_plan",
       "marketplace_listing",
       "description",
       "bullets",
       "has_free_trial",
       "created_at",
-      "actor_id",
       "operation_type",
-      "_document_id",
-      "action",
-      "user_agent",
-      "request_id",
-      "actor",
       "monthly_price_in_cents",
-      "yearly_price_in_cents",
-      "@timestamp"
+      "yearly_price_in_cents"
     ]
   },
   {
@@ -6065,21 +9223,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "marketplace_listing_plan",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "marketplace_listing_plan",
       "description",
       "yearly_price_in_cents",
-      "@timestamp",
       "created_at",
-      "actor_id",
       "bullets",
       "has_free_trial",
       "marketplace_listing",
-      "user_agent",
       "monthly_price_in_cents",
-      "action",
       "operation_type"
     ]
   },
@@ -6088,21 +9261,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "monthly_price_in_cents",
-      "marketplace_listing",
+      "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "monthly_price_in_cents",
+      "marketplace_listing",
       "description",
       "bullets",
       "yearly_price_in_cents",
-      "request_id",
-      "actor_id",
       "has_free_trial",
       "marketplace_listing_plan",
-      "user_agent",
-      "@timestamp",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -6111,22 +9299,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -6134,22 +9335,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6157,19 +9371,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6177,21 +9403,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6201,16 +9436,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6220,18 +9468,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6241,14 +9502,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6256,19 +9533,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -6276,18 +9564,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6295,23 +9595,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -6319,20 +9627,30 @@
     "description": "An OAuth access token was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
     "fields": [
-      "_document_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "user",
-      "user_id",
-      "created_at",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "request_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
@@ -6343,19 +9661,30 @@
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "explanation",
-      "hashed_token",
-      "actor_id",
-      "token_scopes",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
@@ -6365,19 +9694,30 @@
     "description": "An OAuth access token was regenerated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "_document_id",
-      "created_at",
       "@timestamp",
-      "operation_type",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ]
   },
@@ -6386,16 +9726,28 @@
     "description": "An OAuth access token was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "request_access_security_header",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
       "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6405,39 +9757,63 @@
     "description": "An OAuth access token was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
       "action",
-      "@timestamp",
-      "user",
-      "user_agent",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "oauth_application.create",
-    "description": "An OAuth application was created.",
-    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
-    "fields": [
-      "org",
-      "created_at",
-      "oauth_application_id",
-      "operation_type",
-      "user_agent",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "actor",
-      "oauth_application",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "oauth_application.create",
+    "description": "An OAuth application was created.",
+    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
+    "fields": [
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6446,20 +9822,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6468,20 +9856,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6490,20 +9890,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6512,19 +9924,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6533,20 +9958,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6555,20 +9992,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6578,18 +10027,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "org_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "oauth_application_id",
-      "action",
       "created_at",
-      "actor",
-      "actor_id",
-      "oauth_application",
-      "_document_id",
-      "request_id"
+      "oauth_application"
     ]
   },
   {
@@ -6597,19 +10059,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
       "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "user_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6618,15 +10093,32 @@
     "description": "An OAuth application was unsuspended for a user or organization account.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "operation_type",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "oauth_application_id",
       "oauth_application",
-      "org",
-      "created_at",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -6635,24 +10127,31 @@
     "description": "An authorization for an OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "user_id",
-      "actor",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
       "actor_id",
-      "user",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "actor_is_bot",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -6662,20 +10161,31 @@
     "description": "An authorization for an OAuth application was deleted.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "actor",
       "created_at",
       "explanation",
-      "user",
-      "user_id",
-      "org_id",
-      "action",
-      "actor_id",
-      "token_scopes",
       "actor_is_bot",
       "oauth_application_name"
     ],
@@ -6686,20 +10196,31 @@
     "description": "An authorization for an OAuth application was updated.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
-      "actor_id",
       "user_agent",
-      "@timestamp",
       "operation_type",
-      "action",
-      "user",
       "created_at",
-      "_document_id",
       "actor_is_bot",
-      "request_access_security_header",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -6709,17 +10230,28 @@
     "description": "An invitation sent to an organization to join an enterprise was accepted.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6730,20 +10262,30 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
   },
@@ -6752,21 +10294,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -6775,24 +10327,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -6800,42 +10362,62 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
-      "org",
-      "team",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "programmatic_access_type"
-    ]
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type"
+    ]
   },
   {
     "action": "org.advanced_security_disabled_for_new_repos",
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6843,22 +10425,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6866,20 +10456,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6887,22 +10487,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6910,21 +10518,31 @@
     "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "new_policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -6934,19 +10552,30 @@
     "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -6955,19 +10584,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -6977,16 +10617,29 @@
     "description": "A user initiated a background job to delete an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ]
   },
@@ -6995,16 +10648,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -7013,18 +10679,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
-      "actor",
-      "user_agent",
-      "org_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "blocked_user",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -7033,19 +10712,30 @@
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -7055,22 +10745,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "email",
-      "@timestamp",
-      "actor",
-      "action",
       "operation_type",
-      "user_agent",
-      "org",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -7078,19 +10779,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -7098,23 +10810,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7122,21 +10842,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7144,23 +10874,31 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7168,23 +10906,31 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7192,21 +10938,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -7215,21 +10970,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -7238,16 +11002,29 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
@@ -7257,17 +11034,30 @@
     "description": "The interaction limit for prior contributors only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -7276,17 +11066,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -7296,16 +11099,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -7314,17 +11130,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -7333,17 +11162,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -7352,22 +11194,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -7376,17 +11226,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -7397,18 +11258,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
-      "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -7417,39 +11290,61 @@
     "description": "An organization was deleted by a user or staff.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "org_id",
-      "org",
       "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
-    ]
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
   },
   {
     "action": "org.disable_member_team_creation_permission",
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -7458,19 +11353,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -7479,14 +11385,31 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sso_url",
       "issuer",
-      "action",
-      "@timestamp",
-      "_document_id",
       "created_at",
-      "org",
       "operation_type"
     ]
   },
@@ -7495,17 +11418,30 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7513,19 +11449,30 @@
     "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7533,19 +11480,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
-      "action",
-      "actor_id",
-      "org_id"
+      "created_at"
     ]
   },
   {
@@ -7553,19 +11511,30 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -7574,19 +11543,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -7595,19 +11575,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "sso_url",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "@timestamp",
-      "issuer",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "sso_url",
+      "created_at",
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -7616,36 +11609,62 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "created_at",
-      "request_id"
-    ],
-    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
+  },
   {
     "action": "org.integration_manager_added",
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -7654,18 +11673,31 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
-      "org",
-      "user_agent",
-      "request_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "manager",
       "operation_type",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7673,23 +11705,32 @@
     "description": "A new user was invited to join an organization.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
     "fields": [
-      "org",
-      "user_id",
-      "invitation_id",
-      "org_id",
-      "user",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -7698,17 +11739,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7718,19 +11770,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7738,19 +11801,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7759,16 +11833,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7776,17 +11863,30 @@
     "description": "An organization was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7794,19 +11894,31 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -7815,18 +11927,29 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
@@ -7836,21 +11959,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7858,21 +11990,30 @@
     "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user",
-      "org_id",
-      "created_at",
-      "request_id",
       "@timestamp",
-      "action",
-      "operation_type",
-      "user_agent",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7880,21 +12021,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -7902,18 +12053,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -7922,19 +12085,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
-      "old_login",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_login",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7942,20 +12117,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -7964,21 +12149,33 @@
     "description": "A self-hosted runner group was created.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -7988,21 +12185,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -8011,23 +12218,33 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
-      "runner_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
+      "runner_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -8036,23 +12253,31 @@
     "description": "A self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -8061,19 +12286,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -8082,25 +12320,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -8109,21 +12358,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -8133,21 +12391,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -8157,20 +12424,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -8179,22 +12456,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -8203,21 +12488,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -8226,21 +12520,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -8249,22 +12552,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -8273,21 +12584,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -8296,21 +12616,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -8320,21 +12649,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -8344,19 +12682,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -8366,21 +12715,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -8390,21 +12748,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -8414,19 +12781,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -8436,22 +12814,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8460,22 +12846,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8484,22 +12878,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8508,21 +12910,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8531,21 +12942,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8554,22 +12974,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8578,22 +13006,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -8602,12 +13038,28 @@
     "description": "The push protection setting was updated for a secret type for your organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "push_protection_setting",
       "secret_type",
       "secret_type_display_name",
@@ -8620,12 +13072,28 @@
     "description": "The push protection pattern configuration was updated for your organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at"
     ],
     "docs_reference_titles": "About push protection"
@@ -8635,26 +13103,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8663,26 +13140,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8690,28 +13175,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8719,26 +13212,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8746,15 +13247,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -8763,15 +13281,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -8780,7 +13315,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -8795,18 +13351,28 @@
     "description": "The cache retention policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8818,18 +13384,28 @@
     "description": "The cache storage policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8841,20 +13417,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -8863,16 +13450,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -8883,18 +13483,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -8903,17 +13516,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8921,18 +13547,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -8941,18 +13579,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -8961,18 +13612,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -8981,22 +13644,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issuer",
-      "business",
       "operation_type",
       "created_at",
-      "request_id",
-      "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9004,19 +13677,31 @@
     "description": "A user account was converted into an organization.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization",
     "fields": [
-      "actor",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "@timestamp",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "owner",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "owner"
     ],
     "docs_reference_titles": "Converting a user into an organization"
   },
@@ -9025,19 +13710,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
-      "oauth_application_id",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "blocked_user",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -9046,23 +13744,34 @@
     "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -9071,20 +13780,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -9093,38 +13814,62 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
-      "actor_id",
-      "old_permission",
-      "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
-    ]
-  },
-  {
-    "action": "org.update_member_repository_creation_permission",
-    "description": "The create repository permission for organization members was changed.",
-    "docs_reference_links": "N/A",
-    "fields": [
       "actor",
-      "action",
-      "@timestamp",
-      "request_id",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_permission",
+      "permission",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "org.update_member_repository_creation_permission",
+    "description": "The create repository permission for organization members was changed.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -9134,20 +13879,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -9156,19 +13912,32 @@
     "description": "An organization's SAML provider settings were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "issuer",
-      "org",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -9176,18 +13945,30 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "org",
-      "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
@@ -9196,11 +13977,28 @@
     "description": "A new organization custom property definition was created.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "description",
@@ -9208,11 +14006,6 @@
       "required",
       "allowed_values",
       "default_value",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9224,11 +14017,28 @@
     "description": "An organization custom property definition was deleted.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "description",
@@ -9236,11 +14046,6 @@
       "required",
       "allowed_values",
       "default_value",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9252,20 +14057,32 @@
     "description": "An organization custom property definition was updated.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "old_values_editable_by",
       "values_editable_by",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -9280,21 +14097,31 @@
     "description": "An organization's custom property value was manually set for the first time.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9306,23 +14133,33 @@
     "description": "An organization's custom property value was deleted.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "definition_id",
-      "property_name",
-      "value",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "definition_id",
+      "property_name",
+      "value",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise"
@@ -9332,20 +14169,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "org_id",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -9354,16 +14204,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -9372,14 +14237,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -9390,16 +14270,31 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "operation_type",
-      "domain_name",
       "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
       "_document_id",
-      "actor_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "domain_name",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -9408,20 +14303,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -9431,23 +14337,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -9456,21 +14373,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -9481,21 +14409,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -9504,20 +14445,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -9526,17 +14481,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9547,20 +14517,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -9569,19 +14553,31 @@
     "description": "A new passkey was added.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9589,19 +14585,31 @@
     "description": "A new passkey was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9609,18 +14617,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9628,16 +14648,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9645,18 +14679,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9664,18 +14710,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9686,22 +14745,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9709,22 +14777,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9732,18 +14809,28 @@
     "description": "The configured restriction for access to resources via personal access tokens was reset and delegated to organizations.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9754,18 +14841,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9776,18 +14876,28 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9798,18 +14908,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9820,18 +14940,28 @@
     "description": "Triggered when the enterprise delegates to the organizations when to require approval for fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9842,17 +14972,30 @@
     "description": "Triggered when you create a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9862,19 +15005,31 @@
     "description": "Triggered when you regenerate a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9882,12 +15037,29 @@
     "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
     "fields": [
-      "user_programmatic_access_name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
       "operation_type"
     ],
@@ -9898,20 +15070,32 @@
     "description": "Triggered when you delete a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "explanation",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9919,23 +15103,34 @@
     "description": "A personal access token expiration limit was set.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "token_expiration",
       "old_token_expiration",
       "exempt_administrators",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9943,21 +15138,32 @@
     "description": "A personal access token expiration limit was unset.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "programmatic_access_type",
-      "old_token_expiration",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_token_expiration",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9965,17 +15171,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9986,18 +15205,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -10009,17 +15241,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -10031,17 +15276,30 @@
     "description": "A fine-grained personal access token was updated.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -10052,15 +15310,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -10070,17 +15343,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -10090,15 +15374,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -10108,17 +15407,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -10128,17 +15438,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -10148,17 +15469,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -10168,17 +15500,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -10188,17 +15531,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -10208,17 +15564,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10226,20 +15595,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -10249,25 +15629,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -10275,20 +15667,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10296,25 +15700,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10322,17 +15738,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10340,36 +15769,61 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
-      "actor_id",
-      "operation_type",
-      "actor",
-      "user_id",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "user_agent",
-      "user"
-    ]
-  },
-  {
-    "action": "project_field.create",
-    "description": "A field was created in a project board.",
-    "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "project_field.create",
+    "description": "A field was created in a project board.",
+    "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -10378,18 +15832,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -10398,19 +15864,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -10418,17 +15895,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -10440,22 +15930,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -10463,19 +15962,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10483,17 +15993,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10501,18 +16024,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -10520,39 +16056,61 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
-      "actor",
-      "created_at",
-      "org",
       "_document_id",
-      "org_id",
       "action",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "project_view.create",
-    "description": "A view was created in a project board.",
-    "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
-    "fields": [
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "project_view.create",
+    "description": "A view was created in a project board.",
+    "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -10561,18 +16119,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -10581,16 +16151,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -10602,21 +16185,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -10624,22 +16219,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -10648,29 +16253,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10678,24 +16288,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "repo_id",
-      "user_id",
       "@timestamp",
-      "user_agent",
-      "repo",
-      "name",
-      "org_id",
-      "user",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -10706,21 +16324,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -10731,22 +16359,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10754,24 +16392,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "authorized_actors_only",
       "authorized_actors",
       "created_at",
-      "user_agent",
       "name",
-      "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
-      "actor_id",
-      "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -10779,30 +16427,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -10812,28 +16467,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -10844,23 +16507,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -10868,22 +16540,32 @@
     "description": "Branch deletion was enabled or disabled for a protected branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "operation_type",
-      "request_id",
-      "repo",
       "@timestamp",
-      "org_id",
-      "org",
-      "action",
-      "allow_deletions_enforcement_level",
       "_document_id",
-      "created_at",
-      "actor_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_deletions_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10891,23 +16573,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "actor_id",
-      "name",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo",
-      "operation_type",
-      "request_id",
-      "allow_force_pushes_enforcement_level",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_force_pushes_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10915,24 +16606,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -10941,22 +16641,32 @@
     "description": "Required linear commit history was enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "operation_type",
       "actor",
-      "linear_history_requirement_enforcement_level",
-      "repo",
-      "request_id",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "org",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "linear_history_requirement_enforcement_level",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -10964,24 +16674,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "lock_allows_fetch_and_merge",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10990,27 +16709,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -11019,18 +16745,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11041,24 +16780,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -11066,25 +16814,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -11092,22 +16847,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -11115,22 +16880,33 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
   },
@@ -11139,22 +16915,32 @@
     "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "required_approving_review_count",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -11162,25 +16948,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
     ]
   },
   {
@@ -11188,22 +16981,32 @@
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "name",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
       "action",
       "actor",
       "actor_id",
-      "signature_requirement_enforcement_level",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "programmatic_access_type"
+      "operation_type",
+      "name",
+      "created_at",
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -11211,22 +17014,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "created_at",
-      "repo_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "name",
-      "actor",
-      "repo",
       "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
+      "strict_required_status_checks_policy"
     ]
   },
   {
@@ -11234,23 +17047,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -11259,24 +17083,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -11285,20 +17120,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -11307,21 +17156,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -11331,22 +17193,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -11355,25 +17229,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
-      "actor",
-      "key",
-      "fingerprint",
       "@timestamp",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "title",
+      "_document_id",
       "action",
-      "user_agent",
-      "created_at",
-      "repo",
-      "read_only",
-      "operation_type",
-      "_document_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "key",
+      "fingerprint",
+      "oauth_application_id",
+      "title",
+      "created_at",
+      "read_only",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -11382,23 +17266,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -11407,18 +17302,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -11428,21 +17337,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -11451,19 +17371,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -11474,23 +17407,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -11500,17 +17445,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11518,19 +17477,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -11538,19 +17510,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -11560,21 +17545,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
+      "operation_type",
+      "created_at",
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -11583,27 +17579,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "pull_request_url",
       "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11611,23 +17614,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -11636,18 +17651,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -11655,19 +17684,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -11677,20 +17718,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
-      "repo",
-      "created_at",
-      "request_id",
-      "comment_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "comment_id",
+      "operation_type"
     ]
   },
   {
@@ -11698,18 +17750,31 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "_document_id",
-      "@timestamp",
-      "comment_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "comment_id"
     ]
   },
   {
@@ -11717,21 +17782,33 @@
     "description": "A review on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -11739,20 +17816,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -11761,19 +17851,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "pull_request_id",
-      "review_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "pull_request_url",
-      "programmatic_access_type",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
+      "review_id",
+      "operation_type",
+      "created_at",
+      "pull_request_url",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -11783,22 +17887,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -11807,21 +17921,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -11830,25 +17953,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -11857,23 +17987,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -11882,24 +18020,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -11908,23 +18053,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -11934,22 +18087,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -11958,19 +18120,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11979,24 +18154,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
-      "org",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -12005,24 +18190,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -12030,24 +18223,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -12055,24 +18256,32 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -12080,24 +18289,32 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -12105,23 +18322,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -12132,17 +18358,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -12152,17 +18390,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -12172,25 +18422,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -12199,26 +18455,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -12227,25 +18491,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "query_suite",
       "threat_model",
       "languages",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -12255,20 +18528,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "visibility",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -12276,17 +18560,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -12295,15 +18592,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -12314,16 +18624,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -12333,17 +18656,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -12353,19 +18689,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -12374,17 +18721,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -12393,26 +18753,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -12421,30 +18787,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -12454,20 +18825,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12476,25 +18858,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12503,23 +18893,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12527,25 +18928,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -12555,17 +18965,30 @@
     "description": "A repository was archived on disk.",
     "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
-      "repo_id",
-      "actor",
       "action",
-      "user_agent"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository/archiving-repositories"
   },
@@ -12574,23 +18997,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -12600,20 +19032,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "visibility",
-      "repo_id",
-      "created_at",
-      "actor",
-      "action",
-      "@timestamp",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -12621,20 +19064,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
-      "repo_id",
-      "request_id",
-      "action",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "operation_type",
-      "actor",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
       "public_repo"
     ]
   },
@@ -12643,19 +19097,30 @@
     "description": "The repository was unlocked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -12663,20 +19128,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "action",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "operation_type",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "visibility",
-      "actor",
-      "user_id"
+      "visibility"
     ]
   },
   {
@@ -12684,23 +19160,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -12708,21 +19194,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12730,21 +19226,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -12752,22 +19258,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -12775,21 +19290,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -12797,20 +19322,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -12818,22 +19354,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12841,18 +19386,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -12860,22 +19419,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -12883,21 +19452,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12905,18 +19484,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -12925,22 +19516,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12949,24 +19549,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12975,23 +19583,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12999,26 +19617,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -13027,21 +19650,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -13050,25 +19682,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -13076,22 +19714,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -13100,20 +19748,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "visibility",
-      "operation_type",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "@timestamp",
-      "request_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -13121,19 +19780,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13141,17 +19811,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -13160,17 +19845,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -13179,7 +19879,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -13194,22 +19915,30 @@
     "description": "The cache retention policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -13221,22 +19950,30 @@
     "description": "The cache storage policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -13248,23 +19985,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -13274,20 +20020,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -13298,21 +20055,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -13321,22 +20089,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -13345,21 +20123,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -13368,22 +20157,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -13394,16 +20193,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -13412,22 +20222,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -13437,22 +20256,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -13461,23 +20291,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -13487,19 +20327,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -13507,21 +20357,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -13530,24 +20390,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13555,25 +20424,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -13582,24 +20458,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13608,25 +20494,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -13635,22 +20529,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13659,26 +20562,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "visibility",
-      "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "visibility",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -13686,31 +20597,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13719,24 +20637,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -13745,24 +20669,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -13771,25 +20701,31 @@
     "description": "Code security was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13798,25 +20734,31 @@
     "description": "Code security was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13825,21 +20767,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -13847,21 +20799,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13869,42 +20831,65 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "repository_invitation.cancel",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
+    ]
+  },
+  {
+    "action": "repository_invitation.cancel",
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -13912,21 +20897,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13934,19 +20930,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -13954,31 +20963,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -13987,19 +21004,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -14007,8 +21035,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -14017,23 +21044,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -14058,26 +21094,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -14086,26 +21128,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -14114,24 +21162,31 @@
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
       "business",
       "business_id",
-      "public_repo"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -14140,23 +21195,30 @@
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14166,24 +21228,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14193,24 +21262,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -14219,24 +21295,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14246,23 +21329,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14272,23 +21362,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14297,22 +21395,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14320,24 +21426,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -14346,24 +21460,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -14372,19 +21494,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14393,24 +21527,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14419,24 +21561,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14445,19 +21595,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14466,26 +21628,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14494,26 +21661,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14522,28 +21694,36 @@
     "description": "A code security configuration was applied to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14551,27 +21731,35 @@
     "description": "A code security configuration failed to attach to the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14579,28 +21767,36 @@
     "description": "A code security configuration was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14608,28 +21804,36 @@
     "description": "A code security configuration was removed due to a change in repository or enterprise settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14637,29 +21841,37 @@
     "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -14668,29 +21880,37 @@
     "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -14699,19 +21919,32 @@
     "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
-      "operation_type",
-      "request_id",
-      "repo_id",
       "@timestamp",
-      "user_agent",
-      "alert_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "alert_id",
+      "created_at",
+      "alert_number"
     ],
     "docs_reference_titles": "About Dependabot alerts"
   },
@@ -14720,23 +21953,32 @@
     "description": "A Dependabot alert was manually dismissed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "alert_id",
-      "actor",
-      "repo",
       "created_at",
-      "org",
-      "_document_id",
-      "action",
-      "actor_id",
       "dismiss_reason",
-      "user",
       "dismiss_comment",
       "alert_number",
       "actor_is_bot"
@@ -14747,21 +21989,33 @@
     "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "public_repo",
       "owner",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "token_scopes",
       "alert_number"
     ]
   },
@@ -14770,26 +22024,34 @@
     "description": "A Dependabot alert was manually reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo",
-      "alert_number",
-      "request_access_security_header"
+      "alert_number"
     ]
   },
   {
@@ -14797,21 +22059,32 @@
     "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "alert_id",
-      "repo",
-      "operation_type",
-      "action",
-      "repo_id",
-      "_document_id",
-      "user_agent",
-      "request_id",
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "operation_type",
+      "created_at",
+      "alert_number"
     ]
   },
   {
@@ -14819,21 +22092,35 @@
     "description": "A Dependabot alert was withdrawn.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
       "created_at",
       "active",
-      "action",
-      "repository_id",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type"
     ]
   },
@@ -14842,20 +22129,30 @@
     "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
     "fields": [
-      "org",
+      "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
-      "operation_type",
-      "created_at",
-      "actor",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
   },
@@ -14864,24 +22161,31 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -14889,26 +22193,32 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14916,23 +22226,30 @@
     "description": "Dependabot alerts was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "request_id",
-      "repo_id",
-      "action",
-      "actor_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "_document_id",
       "user_id",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14940,23 +22257,30 @@
     "description": "Dependabot alerts was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_agent",
-      "created_at",
       "@timestamp",
-      "repo_id",
+      "_document_id",
       "action",
-      "user",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor_id",
-      "_document_id",
-      "user_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -14965,18 +22289,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -14985,19 +22322,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -15006,14 +22355,28 @@
     "description": "A user was assigned to a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15028,14 +22391,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15049,22 +22426,32 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
@@ -15073,28 +22460,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -15102,25 +22498,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -15128,14 +22531,28 @@
     "description": "A user was unassigned from a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15150,14 +22567,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -15174,19 +22605,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15195,62 +22637,94 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
-    ],
-    "docs_reference_titles": "About secret scanning"
-  },
-  {
-    "action": "secret_scanning_new_repos.disable",
-    "description": "Secret scanning was disabled for all new repositories.",
-    "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
-    "fields": [
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
   {
-    "action": "secret_scanning_new_repos.enable",
-    "description": "Secret scanning was enabled for all new repositories.",
+    "action": "secret_scanning_new_repos.disable",
+    "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "About secret scanning"
+  },
+  {
+    "action": "secret_scanning_new_repos.enable",
+    "description": "Secret scanning was enabled for all new repositories.",
+    "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
+    "fields": [
       "@timestamp",
-      "_document_id"
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15259,14 +22733,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -15284,25 +22772,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -15311,25 +22807,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -15339,25 +22843,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -15366,22 +22878,35 @@
     "description": "A secret scanning scan has completed on this repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "repo_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "source",
       "type",
       "source_slug",
       "type_slug",
       "started_at",
       "completed_at",
-      "repo",
       "public_repo",
-      "org",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "secret_types",
@@ -15395,10 +22920,28 @@
     "description": "A security configuration was created",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15413,15 +22956,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15439,22 +22975,33 @@
     "description": "A default security configuration setting for new repositories was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15463,22 +23010,33 @@
     "description": "A default security configuration setting for new repositories was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "default_for_new_private_repos",
-      "default_for_new_public_repos",
-      "security_configuration_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "default_for_new_private_repos",
+      "default_for_new_public_repos",
+      "security_configuration_name",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15487,10 +23045,28 @@
     "description": "A security configuration was deleted",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15505,15 +23081,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15530,15 +23099,30 @@
     "description": "A security configuration policy was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enforcement",
       "security_configuration_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15548,10 +23132,28 @@
     "description": "A security configuration was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15566,15 +23168,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15592,18 +23187,30 @@
     "description": "A security key was registered for an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15611,18 +23218,30 @@
     "description": "A security key was removed from an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -15630,14 +23249,28 @@
     "description": "A user linked a social identity to their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -15647,14 +23280,28 @@
     "description": "A user unlinked a social identity from their account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -15664,15 +23311,28 @@
     "description": "A user unlinked all social identities from their account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -15682,16 +23342,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15701,18 +23374,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -15721,16 +23407,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15741,15 +23440,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -15759,15 +23471,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -15776,17 +23503,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -15795,17 +23535,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -15814,16 +23568,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -15833,14 +23600,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -15850,17 +23632,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -15869,17 +23664,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -15888,18 +23696,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "sponsors_listing_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sponsors_listing_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -15908,15 +23729,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -15926,16 +23761,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -15943,15 +23791,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -15962,16 +23823,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -15981,17 +23855,30 @@
     "description": "Triggered when you send an email update to your sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
     "fields": [
-      "request_id",
-      "actor",
-      "action",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
   },
@@ -16000,17 +23887,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -16021,17 +23921,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -16042,18 +23955,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16063,16 +23987,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16082,17 +24019,30 @@
     "description": "You join the waitlist to join GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
-      "user_agent",
       "actor_id",
-      "action",
-      "operation_type",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -16101,16 +24051,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16122,17 +24085,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16141,19 +24117,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16162,21 +24151,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "user",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
       "action",
-      "user_id",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "@timestamp",
-      "actor_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16185,19 +24183,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16206,20 +24215,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16227,18 +24250,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -16246,16 +24284,31 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "domain_name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16263,47 +24316,67 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
-    ]
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
+      "public_repo",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
+    ]
   },
   {
     "action": "sub_issues.parent_issue_remove",
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16311,23 +24384,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16335,23 +24418,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16359,15 +24452,30 @@
     "description": "Triggered when you accept a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -16376,15 +24484,30 @@
     "description": "Triggered when you cancel a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -16393,15 +24516,30 @@
     "description": "Triggered when you create a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -16410,15 +24548,30 @@
     "description": "Triggered when you decline a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -16427,15 +24580,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16443,38 +24611,63 @@
     "description": "Triggered when you revoke a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
-    ],
-    "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
-  },
-  {
-    "action": "team.add_member",
-    "description": "A member of an organization was added to a team.",
-    "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "actor_id",
-      "created_at",
+      "user_id",
+      "user_agent",
       "operation_type",
+      "created_at"
+    ],
+    "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
+  },
+  {
+    "action": "team.add_member",
+    "description": "A member of an organization was added to a team.",
+    "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
+    "fields": [
+      "@timestamp",
       "_document_id",
-      "org",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -16484,22 +24677,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -16508,20 +24710,30 @@
     "description": "A team was added to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team_type",
       "team",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -16532,20 +24744,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -16554,18 +24777,31 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
       "created_at",
       "operation_type",
-      "actor_id",
-      "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
@@ -16575,21 +24811,32 @@
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -16598,21 +24845,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -16621,19 +24878,31 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "team",
       "org_id",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
       "operation_type",
-      "_document_id",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -16642,19 +24911,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
       "business",
-      "action",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16662,19 +24942,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "request_id",
       "actor",
-      "org",
-      "created_at",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16682,18 +24973,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
       "@timestamp",
-      "action",
       "_document_id",
-      "user_agent",
-      "user_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -16702,22 +25004,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -16726,20 +25037,30 @@
     "description": "A team was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team_type",
       "team",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -16750,22 +25071,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -16775,21 +25105,31 @@
     "description": "A repository was removed from a team's control.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "org",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -16797,21 +25137,32 @@
     "description": "A team's name was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "user_agent",
-      "created_at",
-      "team",
-      "operation_type",
-      "actor_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -16820,17 +25171,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -16839,49 +25203,69 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id"
-    ],
-    "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
   {
     "action": "team.update_repository_permission",
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
       "operation_type",
       "created_at",
-      "user_agent",
       "permission",
       "new_repo_permission",
       "new_repo_base_role",
       "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_repo_base_role"
     ]
   },
   {
@@ -16889,17 +25273,30 @@
     "description": "A new trusted device was added.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16907,17 +25304,30 @@
     "description": "A trusted device was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16925,14 +25335,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "action",
-      "request_id",
-      "user_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -16941,15 +25366,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "created_at",
-      "user_id",
-      "operation_type",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16957,13 +25397,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "created_at",
-      "user_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16971,17 +25428,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "operation_type",
-      "action",
-      "_document_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16989,17 +25459,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -17007,16 +25490,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17024,34 +25521,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "user",
       "_document_id",
-      "request_id"
-    ]
-  },
-  {
-    "action": "two_factor_authentication.add_factor",
-    "description": "A secondary authentication factor was added to a user account.",
-    "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
-    "fields": [
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "two_factor_authentication.add_factor",
+    "description": "A secondary authentication factor was added to a user account.",
+    "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -17060,18 +25584,30 @@
     "description": "Two-factor authentication was disabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
     "fields": [
-      "actor",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_id",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Disabling two-factor authentication for your personal account"
   },
@@ -17080,18 +25616,30 @@
     "description": "Two-factor authentication was enabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
-      "actor",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Configuring two-factor authentication"
   },
@@ -17100,15 +25648,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user",
-      "user_id",
-      "action",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "user_agent"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17116,16 +25679,29 @@
     "description": "Two factor recovery codes were regenerated for a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
+      "operation_type",
       "created_at"
     ]
   },
@@ -17134,18 +25710,30 @@
     "description": "A secondary authentication factor was removed from a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -17154,15 +25742,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "created_at",
-      "_document_id",
-      "action",
-      "@timestamp"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17171,16 +25774,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "operation_type",
       "user_agent",
-      "action",
-      "request_id",
-      "actor",
-      "actor_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17188,19 +25804,31 @@
     "description": "An email address was added to a user account.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "actor_id",
-      "actor",
       "email",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding an email address to your GitHub account"
   },
@@ -17209,18 +25837,30 @@
     "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "created_at",
-      "user",
       "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
       "action",
-      "request_access_security_header"
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17228,15 +25868,28 @@
     "description": "Audit log entries were exported.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "action",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ]
@@ -17246,20 +25899,31 @@
     "description": "A user was blocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_id",
-      "_document_id",
       "actor_id",
-      "@timestamp",
-      "user_agent",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -17267,18 +25931,30 @@
     "description": "A user changed their password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "actor_id",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17286,18 +25962,30 @@
     "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -17306,17 +25994,30 @@
     "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -17325,23 +26026,38 @@
     "description": "Triggered when a user content edit is deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_content_id",
       "user_content_type",
       "created_at",
-      "user_agent",
       "deleted_by",
       "editor_id",
-      "_document_id",
       "deleted_at",
-      "action",
-      "actor_id",
       "editor",
       "deleted_by_id",
       "deleted_content",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -17349,16 +26065,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
-      "user",
       "action",
-      "operation_type",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17366,16 +26096,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "_document_id",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17383,58 +26127,96 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user_id",
-      "@timestamp",
-      "user",
-      "action",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "user.create",
-    "description": "A new user account was created.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "email",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "created_at",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "programmatic_access_type"
-    ]
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "user.create",
+    "description": "A new user account was created.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "email",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "user.create_integration_secret",
     "description": "A user secret for Codespaces was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17442,20 +26224,31 @@
     "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "oauth_application_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "@timestamp",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -17463,18 +26256,30 @@
     "description": "A user account was destroyed by an asynchronous job.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17483,19 +26288,30 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "oauth_application_id",
+      "_document_id",
       "action",
-      "user",
-      "created_at",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17503,18 +26319,30 @@
     "description": "A user deleted his or her account, triggering user.async_delete.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
-      "created_at",
-      "user_agent",
       "user_id",
-      "operation_type",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17522,18 +26350,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "user_agent",
       "user_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17541,18 +26381,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "_document_id",
-      "@timestamp",
-      "user",
-      "actor_id",
-      "action",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -17561,35 +26413,60 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "request_id",
       "actor",
       "actor_id",
-      "user_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "user.disable_collaborators_only",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "user.disable_collaborators_only",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -17597,17 +26474,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -17615,17 +26505,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -17633,21 +26536,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -17655,21 +26568,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -17678,17 +26601,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -17696,17 +26632,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -17714,17 +26663,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -17732,18 +26694,30 @@
     "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "org_id",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17751,35 +26725,62 @@
     "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "user_id",
-      "action",
       "_document_id",
-      "user_agent",
-      "created_at"
-    ]
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
   },
   {
     "action": "user.forgot_password",
     "description": "A user requested a password reset.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
     "fields": [
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "email",
-      "created_at",
-      "user_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
   },
@@ -17788,17 +26789,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "created_at",
-      "user_agent",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "request_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17806,18 +26820,30 @@
     "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -17826,19 +26852,31 @@
     "description": "A user signed in.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "actor_id",
       "@timestamp",
-      "user",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "actor",
-      "passkey_nickname",
-      "request_access_security_header"
+      "passkey_nickname"
     ]
   },
   {
@@ -17846,18 +26884,30 @@
     "description": "A user signed out.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17865,19 +26915,30 @@
     "description": "A comment made by a user was minimized.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
-      "actor_id",
       "@timestamp",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "user",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -17885,18 +26946,30 @@
     "description": "A user signed in from a new device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17904,14 +26977,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -17919,21 +27008,31 @@
     "description": "An ordinary user account was promoted to a site administrator.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
+      "user_id",
       "user_agent",
+      "created_at",
       "oauth_application_id",
-      "request_id",
-      "operation_type",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17941,16 +27040,29 @@
     "description": "A user's account was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user",
-      "action",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "operation_type"
     ]
   },
@@ -17959,20 +27071,31 @@
     "description": "An email address was removed from a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "actor_id",
       "created_at",
-      "email",
-      "token_scopes",
-      "programmatic_access_type"
+      "email"
     ]
   },
   {
@@ -17980,20 +27103,32 @@
     "description": "A user secret for Codespaces was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "key",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -18001,17 +27136,30 @@
     "description": "A user account was no longer flagged as a large scale contributor.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -18019,20 +27167,31 @@
     "description": "A username was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "request_id",
-      "actor_id",
-      "old_login",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_login",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -18040,17 +27199,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "user_agent",
-      "request_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -18059,18 +27230,30 @@
     "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "action",
       "created_at",
-      "actor",
-      "operation_type",
-      "actor_id",
-      "user_id",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam"
   },
@@ -18079,18 +27262,30 @@
     "description": "A user reset their account password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -18098,16 +27293,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -18118,16 +27326,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -18136,18 +27356,30 @@
     "description": "A user signed in from an unrecognized device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user",
-      "user_id",
-      "operation_type",
-      "created_at",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18155,18 +27387,30 @@
     "description": "A user signed in from an unrecognized device and location.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "created_at",
-      "_document_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -18174,18 +27418,30 @@
     "description": "A user signed in from an unrecognized location.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "action",
-      "operation_type",
-      "user_agent",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
       "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18193,22 +27449,33 @@
     "description": "Triggered when you clear the status on your profile.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "message",
-      "user",
-      "actor_id",
       "created_at",
-      "request_id",
       "limited_availability",
-      "action",
       "emoji",
-      "operation_type",
-      "user_agent",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -18216,23 +27483,33 @@
     "description": "Triggered when you set or change the status on your profile.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
     "fields": [
-      "limited_availability",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "message",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "limited_availability",
+      "message",
+      "created_at",
       "emoji",
-      "org",
-      "actor",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
   },
@@ -18241,21 +27518,31 @@
     "description": "A user account was suspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "user_agent",
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "token_scopes",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18263,18 +27550,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
-      "actor_id",
       "@timestamp",
-      "operation_type",
       "_document_id",
-      "user_agent",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18282,18 +27581,30 @@
     "description": "A 2FA challenge issued for a user account failed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "actor_id",
-      "actor",
-      "user_id",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18303,16 +27614,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
       "user_agent",
-      "request_id",
-      "action",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18320,18 +27643,30 @@
     "description": "A user used their 2FA recovery codes.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18339,18 +27674,30 @@
     "description": "A user downloaded 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18358,17 +27705,30 @@
     "description": "A user printed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18376,18 +27736,30 @@
     "description": "A user viewed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_agent",
-      "actor",
-      "user_id",
-      "action",
-      "created_at",
-      "user",
-      "operation_type",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "request_access_security_header"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -18395,17 +27767,30 @@
     "description": "A user was prompted for a two-factor authentication code.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
     "fields": [
-      "user",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "actor"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
   },
@@ -18414,19 +27799,31 @@
     "description": "A user was unblocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "user_agent",
-      "user_id",
-      "user",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -18435,15 +27832,28 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user_agent",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "request_id",
-      "actor",
-      "action",
       "created_at"
     ]
   },
@@ -18452,21 +27862,31 @@
     "description": "A user account was unsuspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "user_agent",
       "actor",
-      "oauth_application_id",
-      "operation_type",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "user_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -18474,21 +27894,33 @@
     "description": "A user secret for Codespaces was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -18496,18 +27928,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -18515,16 +27959,30 @@
     "description": "A Dependabot rule was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -18534,16 +27992,30 @@
     "description": "A Dependabot rule was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -18553,18 +28025,31 @@
     "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -18574,21 +28059,33 @@
     "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -18596,21 +28093,32 @@
     "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -18618,21 +28126,32 @@
     "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -18640,16 +28159,30 @@
     "description": "A Dependabot rule's conditions, actions, or metadata changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -18659,27 +28192,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -18688,23 +28227,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -18712,10 +28261,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -18726,20 +28293,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -18748,23 +28304,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -18774,10 +28338,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -18789,19 +28371,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -18812,10 +28384,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -18824,21 +28414,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -18848,23 +28427,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -18873,22 +28464,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -18896,21 +28498,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -18918,25 +28531,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -18944,23 +28565,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -18974,24 +28608,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -19000,10 +28643,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -19013,21 +28674,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -19037,25 +28688,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.20/organization.json b/src/audit-logs/data/ghes-3.20/organization.json
index 4131528a7e6e..4c7245c78379 100644
--- a/src/audit-logs/data/ghes-3.20/organization.json
+++ b/src/audit-logs/data/ghes-3.20/organization.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,29 +67,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -72,21 +103,32 @@
     "description": "Credit was accepted for a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Editing a repository security advisory"
   },
@@ -95,21 +137,32 @@
     "description": "Someone was added to the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -117,21 +170,32 @@
     "description": "Credit was declined for a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -140,21 +204,32 @@
     "description": "Someone was removed from the credit section of a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "ghsa_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ghsa_id",
       "recipient",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -163,18 +238,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -182,17 +269,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -203,43 +301,66 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
-  },
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization"
+  },
   {
     "action": "billing.budget_create",
     "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -255,22 +376,34 @@
     "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "uuid",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -278,25 +411,37 @@
     "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
-      "request_access_security_header",
       "old_target_amount",
       "old_budget_limit_type",
       "old_alert_enabled",
@@ -310,17 +455,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -329,19 +487,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -350,15 +520,28 @@
     "description": "Azure subscription has been linked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -368,15 +551,28 @@
     "description": "Azure subscription has been unlinked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -386,18 +582,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -405,16 +614,28 @@
     "description": "The premium request paid usage policy for your GitHub account was changed.",
     "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -426,39 +647,62 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "user_id",
-      "request_id",
-      "actor",
-      "action",
       "@timestamp",
       "_document_id",
-      "programmatic_access_type"
-    ]
-  },
-  {
-    "action": "checks.auto_trigger_disabled",
-    "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
-    "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
-    "fields": [
-      "visibility",
-      "user_agent",
-      "user",
-      "@timestamp",
-      "repo",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "checks.auto_trigger_disabled",
+    "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
+    "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -467,20 +711,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -491,17 +746,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -509,15 +776,31 @@
     "description": "Existing code scanning alerts appeared in a branch.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -527,15 +810,31 @@
     "description": "Code scanning alerts were fixed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -545,15 +844,31 @@
     "description": "Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_numbers",
       "commit_oid",
-      "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business"
+      "ref"
     ],
     "docs_reference_titles": "About code scanning"
   },
@@ -562,15 +877,29 @@
     "description": "Code scanning alerts were manually dismissed.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers",
       "dismissal_approver_id"
     ],
@@ -581,19 +910,31 @@
     "description": "Dismissal of code scanning alerts was approved.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -604,19 +945,31 @@
     "description": "Dismissal of code scanning alerts was denied.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "dismissal_request_id",
-      "alert_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismissal_request_id",
+      "alert_number",
+      "public_repo",
       "created_at",
       "operation_type"
     ],
@@ -627,19 +980,31 @@
     "description": "Dismissal of code scanning alerts was requested.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "dismissal_request_id",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -650,13 +1015,31 @@
     "description": "Code scanning alerts were seen for the first time.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -666,15 +1049,31 @@
     "description": "Code scanning alerts that were previously fixed reappeared.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_number",
       "commit_oid",
       "ref",
-      "request_id",
-      "org_id",
-      "org",
-      "business_id",
-      "business",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -684,15 +1083,29 @@
     "description": "Code scanning alerts that were previously dismissed were reopened.",
     "docs_reference_links": "/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning",
     "fields": [
-      "repo_id",
-      "alert_number",
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
-      "business_id",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_number",
       "alert_numbers"
     ],
     "docs_reference_titles": "About code scanning"
@@ -702,14 +1115,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -719,28 +1147,34 @@
     "description": "An attempt to create a codespace from a prebuild was made.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "owner",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "user_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
       "created_at",
       "operation_type",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -748,17 +1182,30 @@
     "description": "Enterprise setting for Codespaces ownership was updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enablement",
       "organization_names",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -769,25 +1216,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -798,22 +1254,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -825,22 +1292,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -849,15 +1327,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -868,15 +1361,28 @@
     "description": "Policies were applied to codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -886,20 +1392,30 @@
     "description": "Policies were removed from codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -907,19 +1423,30 @@
     "description": "Policies were updated for codespaces in an organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -927,17 +1454,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -947,27 +1487,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
-      "org",
       "owner",
       "pull_request_id",
       "machine_type",
-      "user_id",
-      "user",
       "devcontainer_path",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -975,19 +1524,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -995,18 +1557,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -1015,20 +1589,30 @@
     "description": "A commit comment was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "created_at",
-      "@timestamp",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
-      "user_agent",
-      "action",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1036,21 +1620,30 @@
     "description": "A commit comment was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_id",
-      "action",
-      "@timestamp",
-      "repo",
       "org_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1058,21 +1651,33 @@
     "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "reason",
       "plan",
-      "org_id",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1080,13 +1685,28 @@
     "description": "Copilot feature settings were changed at the organization level.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1096,23 +1716,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1120,16 +1747,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -1138,24 +1779,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1163,15 +1810,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1181,20 +1841,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1202,19 +1872,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -1222,21 +1904,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1244,21 +1935,33 @@
     "description": "The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_value",
       "new_value",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -1266,21 +1969,32 @@
     "description": "The excluded paths for GitHub Copilot were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "excluded_paths",
       "owner_type",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1288,14 +2002,28 @@
     "description": "Copilot custom instructions were created for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "custom_instructions"
@@ -1306,14 +2034,28 @@
     "description": "Copilot custom instructions were updated for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "custom_instructions"
@@ -1324,17 +2066,30 @@
     "description": "The plan for GitHub Copilot was updated.",
     "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_plan",
       "plan",
-      "business_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1346,20 +2101,31 @@
     "description": "The plan for GitHub Copilot was scheduled to be downgraded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "current_plan",
       "scheduled_plan"
@@ -1370,18 +2136,30 @@
     "description": "MCP Configuration for Copilot coding agent was updated for a specific repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "new_config",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_config",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1391,22 +2169,33 @@
     "description": "Specific repositories were disabled from using Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "owner_type",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1414,21 +2203,31 @@
     "description": "Specific repositories were enabled to use Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "owner_type",
-      "owner",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1438,20 +2237,32 @@
     "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_access",
       "old_access",
-      "org_id",
       "owner_type",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1461,21 +2272,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1485,19 +2305,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1507,21 +2336,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1531,18 +2369,31 @@
     "description": "A new custom property definition was created.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1555,18 +2406,31 @@
     "description": "A custom property definition was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "value_type",
       "required",
       "default_value",
@@ -1580,14 +2444,29 @@
     "description": "A custom property definition was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "property_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "value_type",
@@ -1600,8 +2479,7 @@
       "old_default_value",
       "old_value_type",
       "old_values_editable_by",
-      "values_editable_by",
-      "request_access_security_header"
+      "values_editable_by"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1610,27 +2488,35 @@
     "description": "A repository's custom property value was manually set for the first time.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1639,19 +2525,31 @@
     "description": "A repository's custom property value was deleted.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization"
   },
@@ -1660,16 +2558,29 @@
     "description": "A repository's custom property value was updated.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repository",
-      "repository_id",
-      "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "public_repo",
       "created_at",
       "operation_type",
       "definition_id"
@@ -1681,19 +2592,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1702,19 +2624,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1723,19 +2656,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1744,19 +2688,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1765,21 +2720,31 @@
     "description": "The default repository access for Dependabot was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "access_level",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -1788,17 +2753,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1806,19 +2784,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1827,19 +2816,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1847,40 +2847,62 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
-    ],
-    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
-  },
-  {
-    "action": "dependabot_security_updates_new_repos.enable",
-    "description": "Dependabot security updates were enabled for all new repositories.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
+  },
+  {
+    "action": "dependabot_security_updates_new_repos.enable",
+    "description": "Dependabot security updates were enabled for all new repositories.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1888,19 +2910,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1909,19 +2942,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1929,19 +2973,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1950,20 +3005,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1971,21 +3036,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "repo_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "org_id",
-      "_document_id",
       "actor_id",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1993,20 +3067,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "request_id",
-      "org",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2014,22 +3098,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "actor_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "title",
-      "_document_id",
-      "created_at",
-      "repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2037,21 +3130,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "team",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "number",
-      "org",
-      "title",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id"
+      "team",
+      "created_at",
+      "number",
+      "title",
+      "operation_type"
     ]
   },
   {
@@ -2059,18 +3164,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user_id",
-      "actor",
       "number",
-      "user",
-      "created_at",
-      "request_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2078,18 +3196,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "_document_id",
-      "request_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "number",
       "team",
       "created_at"
@@ -2100,21 +3229,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "_document_id",
-      "title",
-      "user",
-      "user_agent",
-      "org",
-      "operation_type",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "team",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type",
+      "team",
       "number"
     ]
   },
@@ -2123,17 +3263,31 @@
     "description": "A global announcement banner was created for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2144,16 +3298,30 @@
     "description": "A global announcement banner was removed from the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "owner",
       "owner_type",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2164,18 +3332,32 @@
     "description": "A global announcement banner was updated for the enterprise.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
-      "business_id",
       "message",
       "old_message",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -2186,17 +3368,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was created.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "org_id",
       "action",
-      "request_id",
-      "org",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -2205,17 +3400,30 @@
     "description": "The GitHub App associated with a GitHub Connect connection was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "actor_id",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enabling GitHub Connect for GitHub.com"
   },
@@ -2224,22 +3432,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2248,22 +3465,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2271,28 +3498,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2301,27 +3534,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2330,25 +3571,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2357,26 +3606,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2385,21 +3641,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2408,22 +3676,32 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2432,25 +3710,34 @@
     "description": "A secret was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -2459,22 +3746,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -2483,21 +3782,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -2508,19 +3817,30 @@
     "description": "A repository was cloned. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2529,20 +3849,30 @@
     "description": "Changes were fetched from a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2551,19 +3881,30 @@
     "description": "Changes were pushed to a repository. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
-      "transport_protocol",
-      "request_id",
-      "repository",
-      "repository_id",
-      "repository_public",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "transport_protocol",
+      "repository_public",
       "transport_protocol_name"
     ]
   },
@@ -2572,23 +3913,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2596,18 +3946,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2618,20 +3978,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -2641,25 +4011,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -2667,25 +4047,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -2693,26 +4082,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -2721,25 +4119,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -2747,26 +4154,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -2774,21 +4190,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -2797,19 +4224,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -2817,21 +4257,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -2840,19 +4291,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -2863,20 +4328,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2886,24 +4363,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2914,23 +4402,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2941,21 +4441,33 @@
     "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.",
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
       "operation_type",
-      "@timestamp",
       "integration",
-      "action",
-      "user_agent",
       "reason",
-      "_document_id",
-      "org",
-      "org_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -2966,20 +4478,32 @@
     "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner",
     "fields": [
       "@timestamp",
-      "actor_id",
-      "org",
       "_document_id",
-      "requester",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "requester",
       "created_at",
       "url",
-      "org_id",
-      "request_id",
       "operation_type",
-      "actor",
       "integration",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner"
@@ -2989,20 +4513,33 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_access_security_header",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -3012,19 +4549,33 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -3033,20 +4584,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -3056,20 +4620,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -3078,20 +4655,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -3100,20 +4690,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -3121,19 +4723,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -3142,19 +4757,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -3163,17 +4791,30 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -3186,21 +4827,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -3214,17 +4868,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -3236,19 +4903,30 @@
     "description": "An IP allow list was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "actor",
-      "request_id",
-      "org",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "user_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "user"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3256,19 +4934,30 @@
     "description": "An IP allow list was disabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3276,20 +4965,29 @@
     "description": "An IP allow list was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "user_id",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
-      "_document_id",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "actor_id",
       "operation_type",
-      "org",
       "created_at"
     ]
   },
@@ -3298,19 +4996,30 @@
     "description": "An IP allow list was enabled for installed GitHub Apps.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3318,24 +5027,32 @@
     "description": "An IP address was added to an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
-      "active",
-      "org",
-      "ip_allow_list_entry",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "business",
-      "actor",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3343,24 +5060,32 @@
     "description": "An IP address was deleted from an IP allow list.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "ip_allow_list_entry",
-      "org",
-      "operation_type",
-      "created_at",
-      "active",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "actor_id",
-      "token_scopes",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "ip_allow_list_entry",
+      "operation_type",
+      "created_at",
+      "active"
     ]
   },
   {
@@ -3368,19 +5093,32 @@
     "description": "An IP address or its description was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at",
-      "user_agent",
-      "actor_id",
       "ip_allow_list_entry",
-      "active",
-      "org_id",
-      "@timestamp"
+      "active"
     ]
   },
   {
@@ -3388,22 +5126,31 @@
     "description": "A comment on an issue was deleted from the repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "org",
-      "repo",
-      "actor_id",
       "@timestamp",
-      "created_at",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "oauth_application_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -3411,24 +5158,30 @@
     "description": "A comment on an issue was pinned to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "public_repo",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3439,19 +5192,29 @@
     "description": "A comment on an issue was unpinned from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3462,22 +5225,31 @@
     "description": "A comment on an issue (other than the initial one) changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
-      "action",
-      "repo_id",
-      "org_id",
-      "created_at",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "request_id",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
-      "oauth_application_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -3485,20 +5257,30 @@
     "description": "An issue was marked as blocked by another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3509,19 +5291,30 @@
     "description": "The blocked by relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -3531,20 +5324,30 @@
     "description": "An issue was marked as blocking another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3555,20 +5358,30 @@
     "description": "The blocking relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3579,21 +5392,31 @@
     "description": "An issue was deleted from the repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue",
     "fields": [
-      "user",
-      "actor_id",
-      "created_at",
-      "title",
       "@timestamp",
       "_document_id",
-      "request_id",
-      "actor",
-      "user_id",
       "action",
-      "operation_type",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "title",
+      "operation_type"
     ],
     "docs_reference_titles": "Deleting an issue"
   },
@@ -3602,23 +5425,33 @@
     "description": "An issue was pinned to a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
       "action",
       "actor",
-      "operation_type",
-      "owner_type",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "number",
-      "repo",
-      "event",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "owner_type",
+      "number",
+      "event"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3627,22 +5460,32 @@
     "description": "An issue was transferred to another repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "owner_type",
-      "actor_id",
       "number",
-      "repo",
       "operation_type",
-      "_document_id",
-      "repo_id",
-      "action",
-      "request_id",
-      "created_at",
-      "actor",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Transferring an issue to another repository"
   },
@@ -3651,20 +5494,32 @@
     "description": "An issue type was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issue_type_name",
       "description",
       "color",
       "enabled",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3675,20 +5530,32 @@
     "description": "An issue type was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issue_type_name",
       "description",
       "color",
       "enabled",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3699,11 +5566,28 @@
     "description": "An issue type was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issue_type_name",
       "description",
       "color",
@@ -3712,11 +5596,6 @@
       "old_description",
       "old_color",
       "old_enabled",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3727,24 +5606,33 @@
     "description": "An issue was unpinned from a repository.",
     "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository",
     "fields": [
-      "event",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
-      "action",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "operation_type",
-      "_document_id",
-      "number",
-      "owner_type",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "token_scopes",
-      "request_access_security_header"
+      "user_agent",
+      "event",
+      "created_at",
+      "operation_type",
+      "number",
+      "owner_type"
     ],
     "docs_reference_titles": "Pinning an issue to your repository"
   },
@@ -3753,19 +5641,30 @@
     "description": "The ability for enterprise members to delete issues was disabled  Members cannot delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
-      "operation_type",
-      "request_id",
-      "actor_id",
-      "user_id",
-      "created_at",
       "_document_id",
+      "action",
       "actor",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "org_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3774,18 +5673,29 @@
     "description": "The ability for enterprise members to delete issues was enabled  Members can delete issues in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -3795,19 +5705,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues",
     "fields": [
-      "user",
-      "request_id",
-      "actor",
-      "business_id",
-      "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -3816,18 +5737,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3835,21 +5768,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -3857,21 +5803,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
       "marketplace_listing",
-      "@timestamp",
       "integration",
-      "org_id",
-      "action",
-      "org",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3879,22 +5838,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
+      "user_id",
       "user_agent",
+      "primary_category",
+      "created_at",
       "oauth_application",
-      "action",
-      "request_id",
       "marketplace_listing",
-      "user_id",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -3902,19 +5874,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -3924,22 +5909,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -3947,22 +5945,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -3970,20 +5981,30 @@
     "description": "The ability for members to publish GitHub Pages sites was disabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -3992,20 +6013,30 @@
     "description": "The ability for members to publish GitHub Pages sites was enabled.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4014,21 +6045,30 @@
     "description": "The ability for members to publish private GitHub Pages was disabled  Members cannot publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4037,22 +6077,30 @@
     "description": "The ability for members to publish private GitHub Pages was enabled  Members can publish private GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4061,21 +6109,30 @@
     "description": "The ability for members to publish public GitHub Pages was disabled  Members cannot publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4084,22 +6141,30 @@
     "description": "The ability for members to publish public GitHub Pages was enabled  Members can publish public GitHub Pages in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization"
   },
@@ -4108,19 +6173,30 @@
     "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "operation_type",
       "user_agent",
-      "actor",
-      "actor_id",
-      "business_id",
-      "@timestamp",
-      "created_at",
-      "action"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -4129,18 +6205,29 @@
     "description": "The ability for enterprise members to delete repositories was disabled  Members cannot delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "request_id",
-      "org",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "actor",
       "operation_type",
-      "org_id",
-      "action",
-      "@timestamp",
       "created_at"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
@@ -4150,21 +6237,30 @@
     "description": "The ability for enterprise members to delete repositories was enabled  Members can delete or transfer repositories in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer",
     "fields": [
-      "action",
-      "org_id",
-      "user_id",
-      "business",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business_id",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
-      "org",
-      "operation_type",
-      "user_agent"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing repository management policies in your enterprise"
   },
@@ -4175,16 +6271,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "created_at",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -4193,21 +6300,30 @@
     "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
-      "created_at",
-      "user_id",
       "business_id",
-      "user",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "org_id",
-      "@timestamp"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4216,19 +6332,30 @@
     "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "user_id",
-      "business",
-      "business_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "actor_id"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4237,19 +6364,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4257,21 +6396,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4281,16 +6429,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4300,18 +6461,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4321,14 +6495,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -4336,19 +6526,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -4356,18 +6557,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4375,23 +6588,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -4399,16 +6620,30 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "org_id",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4416,24 +6651,32 @@
     "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
-      "repo_id",
       "operation_type",
-      "@timestamp",
-      "user_agent",
       "created_at",
-      "org",
-      "action",
-      "_document_id",
-      "repo",
-      "actor",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -4441,15 +6684,28 @@
     "description": "A network configuration for a hosted compute service was created.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4467,15 +6723,28 @@
     "description": "A network configuration for a hosted compute service was deleted.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4488,15 +6757,28 @@
     "description": "A network configuration for a hosted compute service was updated.",
     "docs_reference_links": "/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-networking-for-hosted-compute-products",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -4513,20 +6795,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4535,20 +6829,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4557,20 +6863,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4579,20 +6897,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4601,19 +6931,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4622,20 +6965,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4644,20 +6999,32 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4666,19 +7033,32 @@
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -4687,17 +7067,28 @@
     "description": "An invitation sent to an organization to join an enterprise was accepted.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4708,20 +7099,30 @@
     "description": "A billing manager was added to an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "user_id",
       "action",
-      "created_at",
-      "org_id",
-      "user",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
   },
@@ -4730,19 +7131,29 @@
     "description": "An organization prevented access to resources by users with the given two-factor method.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "two_factor_method",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "two_factor_method",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -4753,21 +7164,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -4776,24 +7197,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4801,21 +7232,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -4823,20 +7264,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4844,22 +7295,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4867,20 +7326,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4888,22 +7357,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -4911,21 +7388,31 @@
     "description": "An enterprise owner updated the GitHub Advanced Security access policy for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "new_policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "new_policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -4935,19 +7422,30 @@
     "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
   },
@@ -4956,19 +7454,30 @@
     "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Enforcing policies for code security and analysis for your enterprise"
@@ -4978,15 +7487,28 @@
     "description": "Third-party application access for outside collaborators was disabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -4997,15 +7519,28 @@
     "description": "Third-party application access for outside collaborators was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests-and-installations#enabling-or-disabling-app-access-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5016,15 +7551,28 @@
     "description": "The organization was archived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5034,17 +7582,30 @@
     "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log",
     "fields": [
-      "org_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
   },
@@ -5053,21 +7614,32 @@
     "description": "An export of the organization's Git events was created.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "start",
       "end",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization"
   },
@@ -5076,16 +7648,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_agent",
-      "action",
       "@timestamp",
-      "actor_id",
-      "org_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -5094,18 +7679,31 @@
     "description": "An organization owner blocked a user from accessing the organization's repositories.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "blocked_user",
-      "action",
-      "operation_type",
-      "actor_id",
-      "org",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization"
   },
@@ -5114,19 +7712,30 @@
     "description": "An invitation for an organization to join an enterprise was revoked",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "initiated_from"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
@@ -5136,22 +7745,33 @@
     "description": "An invitation sent to a user to join an organization was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "email",
-      "@timestamp",
-      "actor",
-      "action",
       "operation_type",
-      "user_agent",
-      "org",
       "invitation_id",
-      "_document_id",
       "created_at",
-      "invitee_email",
-      "token_scopes",
-      "programmatic_access_type"
+      "invitee_email"
     ]
   },
   {
@@ -5159,19 +7779,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -5179,16 +7810,28 @@
     "description": "Cleared two-factor authentication restrictions for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -5199,23 +7842,31 @@
     "description": "Autofix for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5223,21 +7874,31 @@
     "description": "Autofix for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5245,23 +7906,31 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5269,23 +7938,31 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -5293,10 +7970,28 @@
     "description": "Enablement for Code Security features on new repositories has been locked for this organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "action",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5305,11 +8000,29 @@
     "action": "org.code_security_metered_usage_unlock",
     "description": "Enablement for Code Security features on new repositories has been unlocked for this organization.",
     "docs_reference_links": "N/A",
-    "fields": [
-      "org_id",
-      "action",
-      "_document_id",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -5319,21 +8032,30 @@
     "description": "Code scanning using the default setup was disabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -5342,21 +8064,30 @@
     "description": "Code scanning using the default setup was enabled for an organization.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning at scale"
   },
@@ -5365,20 +8096,31 @@
     "description": "Access to use Codespaces on internal and private repositories was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "enablement",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "enablement",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization"
   },
@@ -5387,21 +8129,31 @@
     "description": "Ownership and payment for codespaces was updated for an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "owner_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization"
   },
@@ -5410,16 +8162,29 @@
     "description": "A team has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5429,16 +8194,29 @@
     "description": "A team has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -5448,19 +8226,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -5469,17 +8258,30 @@
     "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -5488,21 +8290,30 @@
     "description": "A user has been allowed to use Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5510,21 +8321,30 @@
     "description": "A user has been prevented from using Codespaces for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -5532,16 +8352,29 @@
     "description": "The interaction limit for collaborators only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "request_id",
-      "org",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
@@ -5551,17 +8384,30 @@
     "description": "The interaction limit for prior contributors only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "user_agent",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
-      "actor",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5570,17 +8416,30 @@
     "description": "The interaction limit for existing users only for an organization was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "actor_id",
-      "org_id",
       "action",
-      "created_at",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5590,16 +8449,29 @@
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
-      "actor_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "action",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5608,17 +8480,30 @@
     "description": "The interaction limit for prior contributors only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5627,17 +8512,30 @@
     "description": "The interaction limit for existing users only for an organization was enabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization",
     "fields": [
-      "actor_id",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
-      "user_agent",
       "actor",
-      "_document_id",
-      "org_id",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization"
   },
@@ -5646,22 +8544,30 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization"
   },
@@ -5670,17 +8576,28 @@
     "description": "An invitation for an organization to join an enterprise was confirmed.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5691,15 +8608,28 @@
     "description": "Server statistics were exported for the organization.",
     "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -5710,18 +8640,30 @@
     "description": "An organization was created.",
     "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "org",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "org_id",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch"
   },
@@ -5730,20 +8672,31 @@
     "description": "A GitHub Actions secret was created for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5752,20 +8705,32 @@
     "description": "A GitHub Actions variable was created for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5774,21 +8739,33 @@
     "description": "A Codespaces or Dependabot secret was created for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -5796,21 +8773,30 @@
     "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "org_id",
-      "business",
-      "action",
       "@timestamp",
-      "org",
       "_document_id",
-      "business_id",
+      "action",
       "actor",
-      "token_scopes",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "actor_is_bot",
       "oauth_credential_type",
       "managed_oauth_access_id",
@@ -5826,24 +8812,32 @@
     "description": "A member authorized credentials for use with SAML or OIDC single sign-on.",
     "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
-      "created_at",
-      "org_id",
-      "business_id",
-      "operation_type",
-      "request_id",
       "_document_id",
       "action",
+      "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "token_scopes",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot",
       "oauth_credential_type",
-      "request_access_security_header",
       "managed_oauth_access_id",
       "managed_token_id",
       "managed_oauth_scopes",
@@ -5857,21 +8851,32 @@
     "description": "An owner revoked authorized credentials.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "oauth_application_id",
-      "org_id",
       "operation_type",
-      "action",
-      "business",
-      "request_id",
       "created_at",
-      "business_id",
-      "actor_id",
-      "_document_id",
-      "user_agent",
       "oauth_credential_type",
       "managed_oauth_access_id",
       "managed_token_id",
@@ -5886,18 +8891,30 @@
     "description": "An organization was deleted by a user or staff.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "org_id",
-      "org",
       "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -5905,20 +8922,30 @@
     "description": "Team creation was limited to owners.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "actor",
       "@timestamp",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -5927,16 +8954,29 @@
     "description": "Third-party application access restrictions for an organization were disabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization"
@@ -5946,19 +8986,30 @@
     "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -5967,14 +9018,31 @@
     "description": "SAML single sign-on was disabled for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sso_url",
       "issuer",
-      "action",
-      "@timestamp",
-      "_document_id",
       "created_at",
-      "org",
       "operation_type"
     ]
   },
@@ -5983,21 +9051,30 @@
     "description": "Display of IP addresses within audit log events for the organization was disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -6006,17 +9083,30 @@
     "description": "A two-factor authentication requirement was disabled for the organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org",
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6024,19 +9114,30 @@
     "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "created_at",
-      "user_agent",
-      "org",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "request_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6044,19 +9145,30 @@
     "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "user",
-      "action",
-      "actor_id",
-      "org_id"
+      "created_at"
     ]
   },
   {
@@ -6064,19 +9176,30 @@
     "description": "Team creation by members was allowed.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization",
     "fields": [
-      "org_id",
-      "user",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization"
   },
@@ -6085,17 +9208,30 @@
     "description": "Third-party application access restrictions for an organization were enabled.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization",
     "fields": [
-      "actor_id",
-      "operation_type",
-      "org",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization"
   },
@@ -6104,19 +9240,30 @@
     "description": "An organization owner allowed users with read access to create discussions in an organization",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization"
   },
@@ -6125,19 +9272,32 @@
     "description": "SAML single sign-on was enabled for the organization.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
       "sso_url",
-      "org",
       "created_at",
-      "@timestamp",
-      "issuer",
-      "org_id",
-      "_document_id",
-      "user_agent",
-      "request_id"
+      "issuer"
     ],
     "docs_reference_titles": "Enabling and testing SAML single sign-on for your organization"
   },
@@ -6146,21 +9306,30 @@
     "description": "Display of IP addresses within audit log events for the organization was enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
   },
@@ -6169,17 +9338,30 @@
     "description": "Two-factor authentication is now required for the organization.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "actor_id",
-      "action",
-      "_document_id",
-      "org",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
   },
@@ -6188,17 +9370,30 @@
     "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "org_id",
-      "manager",
       "@timestamp",
-      "request_id",
-      "actor",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "manager",
+      "operation_type",
       "created_at"
     ]
   },
@@ -6207,18 +9402,31 @@
     "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
       "@timestamp",
-      "org",
-      "user_agent",
-      "request_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "manager",
       "operation_type",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6226,23 +9434,32 @@
     "description": "A new user was invited to join an organization.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization",
     "fields": [
-      "org",
-      "user_id",
-      "invitation_id",
-      "org_id",
-      "user",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
-      "created_at",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "invitee_email",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitation_id",
+      "operation_type",
+      "created_at",
+      "invitee_email"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization"
   },
@@ -6251,17 +9468,28 @@
     "description": "An organization was invited to join an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6271,19 +9499,30 @@
     "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -6291,19 +9530,30 @@
     "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "org_id",
-      "user_agent",
-      "actor_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "request_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6311,19 +9561,31 @@
     "description": "Access to an organization was granted for an OAuth App.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization",
     "fields": [
-      "url",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "operation_type",
-      "org_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization"
@@ -6333,20 +9595,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -6355,18 +9628,31 @@
     "description": "Access was disabled for an OAuth App that was previously approved.",
     "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization",
     "fields": [
-      "request_id",
-      "url",
-      "created_at",
-      "org_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "org",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
+      "created_at",
+      "operation_type",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization"
@@ -6376,19 +9662,31 @@
     "description": "An organization member requested that an owner grant an OAuth App access to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "url",
-      "org_id",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "url",
       "oauth_application_name"
     ]
   },
@@ -6397,20 +9695,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "url",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "url",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "oauth_application_name"
     ]
   },
@@ -6420,16 +9729,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "org_id",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "org"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6437,20 +9759,31 @@
     "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "reason",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "reason",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -6459,20 +9792,30 @@
     "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing your organization if your identity provider is unavailable"
   },
@@ -6481,19 +9824,30 @@
     "description": "An organization owner downloaded the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6502,19 +9856,30 @@
     "description": "An organization owner generated the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6523,19 +9888,30 @@
     "description": "An organization owner printed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6544,19 +9920,30 @@
     "description": "An organization owner viewed the organization's SSO recovery codes.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Downloading your organization's SAML single sign-on recovery codes"
   },
@@ -6565,19 +9952,31 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization",
     "fields": [
-      "actor",
-      "operation_type",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "operation_type",
+      "created_at",
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -6586,20 +9985,31 @@
     "description": "A GitHub Actions secret was removed from an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -6608,21 +10018,31 @@
     "description": "A GitHub Actions variable was removed from an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -6631,18 +10051,29 @@
     "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
     "fields": [
-      "user_id",
-      "user_agent",
-      "org_id",
-      "user",
-      "action",
-      "_document_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"
@@ -6652,19 +10083,29 @@
     "description": "Removed a two-factor authentication method restriction for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "two_factor_method",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "two_factor_method",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -6675,22 +10116,32 @@
     "description": "A Codespaces or Dependabot secret was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -6698,21 +10149,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6720,21 +10180,30 @@
     "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
-      "user",
-      "org_id",
-      "created_at",
-      "request_id",
       "@timestamp",
-      "action",
-      "operation_type",
-      "user_agent",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6742,21 +10211,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -6764,18 +10243,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization",
     "fields": [
-      "operation_type",
-      "org_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "actor",
-      "action",
-      "programmatic_access_type"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -6784,19 +10275,31 @@
     "description": "An organization was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "org",
+      "_document_id",
       "action",
       "actor",
-      "old_login",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_login",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6804,14 +10307,28 @@
     "description": "Triggered when a required workflow is created.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6822,14 +10339,28 @@
     "description": "Triggered when a required workflow is deleted.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6840,14 +10371,28 @@
     "description": "Triggered when a required workflow is updated.",
     "docs_reference_links": "/actions/using-workflows/required-workflows",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -6858,20 +10403,30 @@
     "description": "An organization member was restored.",
     "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization",
     "fields": [
-      "user",
-      "actor",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "actor_id",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization"
   },
@@ -6880,18 +10435,29 @@
     "description": "A member's linked identity was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
       "user_id",
-      "@timestamp",
-      "action",
-      "actor_id",
       "user_agent",
-      "_document_id",
-      "request_id",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
@@ -6901,42 +10467,65 @@
     "description": "A member's SAML session was revoked.",
     "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "operation_type",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
+  },
+  {
+    "action": "org.runner_group_created",
+    "description": "A self-hosted runner group was created.",
+    "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
-    ],
-    "docs_reference_titles": "Viewing and managing a member's SAML access to your organization"
-  },
-  {
-    "action": "org.runner_group_created",
-    "description": "A self-hosted runner group was created.",
-    "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization",
-    "fields": [
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "runner_group_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
       "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
@@ -6946,21 +10535,31 @@
     "description": "A self-hosted runner group was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6969,20 +10568,31 @@
     "description": "A self-hosted runner group was renamed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -6991,23 +10601,33 @@
     "description": "The REST API was used to remove a self-hosted runner from a group.",
     "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "runner_group_id",
       "runner_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization"
   },
@@ -7016,23 +10636,31 @@
     "description": "A self-hosted runner was added to a group.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "runner_group_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7041,19 +10669,32 @@
     "description": "A runner group's list of members was updated.",
     "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "runner_group_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "runner_group_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization"
   },
@@ -7062,25 +10703,36 @@
     "description": "The configuration of a self-hosted runner group was changed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_group_id",
       "runner_group_name",
       "runner_group_allow_public",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "runner_group_restricted_to_workflows",
       "runner_group_selected_workflow_refs",
-      "programmatic_access_type",
-      "network_configuration_id",
-      "request_access_security_header"
+      "network_configuration_id"
     ],
     "docs_reference_titles": "Managing access to self-hosted runners using groups"
   },
@@ -7089,21 +10741,32 @@
     "description": "The visibility of a self-hosted runner group was updated via the REST API.",
     "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "runner_group_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "runner_group_id",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ],
     "docs_reference_titles": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization"
   },
@@ -7112,10 +10775,28 @@
     "description": "Enablement for Secret Protection features on new repositories has been locked for this organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "action",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7125,10 +10806,28 @@
     "description": "Enablement for Secret Protection features on new repositories has been unlocked for this organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -7138,21 +10837,30 @@
     "description": "Automatic partner validation checks have been disabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7162,21 +10870,30 @@
     "description": "Automatic partner validation checks have been enabled at the organization level",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization"
@@ -7186,20 +10903,30 @@
     "description": "A custom pattern was created for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7208,22 +10935,30 @@
     "description": "A custom pattern was removed from secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7232,21 +10967,30 @@
     "description": "A custom pattern was published for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7255,21 +10999,30 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7278,22 +11031,30 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7302,21 +11063,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -7325,22 +11095,30 @@
     "description": "Generic secrets have been disabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7348,22 +11126,30 @@
     "description": "Generic secrets have been enabled at the organization level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7371,21 +11157,30 @@
     "description": "Secret scanning for non-provider patterns was disabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7395,21 +11190,30 @@
     "description": "Secret scanning for non-provider patterns was enabled at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
@@ -7419,19 +11223,30 @@
     "description": "A role or team was added to the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7441,21 +11256,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7465,21 +11289,30 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7489,19 +11322,30 @@
     "description": "A role or team was removed from the push protection bypass list at the organization level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
@@ -7511,22 +11355,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7535,22 +11387,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7559,22 +11419,30 @@
     "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7583,21 +11451,30 @@
     "description": "Push protection for secret scanning was disabled.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7606,21 +11483,30 @@
     "description": "Push protection for secret scanning was enabled.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7629,22 +11515,30 @@
     "description": "Push protection for secret scanning was disabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7653,22 +11547,30 @@
     "description": "Push protection for secret scanning was enabled for all new repositories in the organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -7677,12 +11579,28 @@
     "description": "The push protection setting was updated for a secret type for your organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "push_protection_setting",
       "secret_type",
       "secret_type_display_name",
@@ -7695,12 +11613,28 @@
     "description": "The push protection pattern configuration was updated for your organization.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at"
     ],
     "docs_reference_titles": "About push protection"
@@ -7710,26 +11644,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -7738,26 +11681,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7765,28 +11716,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7794,26 +11753,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7821,15 +11788,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7838,15 +11822,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -7855,7 +11856,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -7870,18 +11892,28 @@
     "description": "The cache retention policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -7893,18 +11925,28 @@
     "description": "The cache storage policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -7916,20 +11958,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -7938,16 +11991,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -7958,18 +12024,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -7978,17 +12057,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "org_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "request_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7996,18 +12088,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -8016,18 +12120,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -8036,18 +12153,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -8056,22 +12185,32 @@
     "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
       "actor_id",
-      "org_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "issuer",
-      "business",
       "operation_type",
       "created_at",
-      "request_id",
-      "business_id",
-      "_document_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8079,21 +12218,32 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Adding organizations to your enterprise"
   },
@@ -8102,19 +12252,30 @@
     "description": "An organization was transferred between enterprise accounts.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "from_business",
       "to_business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8125,15 +12286,28 @@
     "description": "The organization was unarchived.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8143,19 +12317,32 @@
     "description": "A user was unblocked from an organization.",
     "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization",
     "fields": [
-      "oauth_application_id",
+      "@timestamp",
       "_document_id",
-      "blocked_user",
       "action",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "created_at",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "blocked_user",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization"
   },
@@ -8164,20 +12351,32 @@
     "description": "A GitHub Actions secret was updated for an organization.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "created_at",
       "key",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -8186,23 +12385,34 @@
     "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "updated_allowed_types",
       "old_policy",
-      "updated_access_policy",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "updated_access_policy"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization"
   },
@@ -8211,20 +12421,32 @@
     "description": "A GitHub Actions variable was updated for an organization.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -8233,20 +12455,32 @@
     "description": "The default repository permission level for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
+      "created_at",
       "permission",
-      "actor_id",
-      "old_permission",
-      "_document_id",
-      "programmatic_access_type"
+      "old_permission"
     ]
   },
   {
@@ -8254,18 +12488,30 @@
     "description": "The settings policy for immutable releases was updated for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_policy",
       "new_policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8276,22 +12522,33 @@
     "description": "A Codespaces or Dependabot secret was updated for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8300,20 +12557,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -8321,17 +12589,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -8341,20 +12622,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -8363,17 +12655,30 @@
     "description": "The name of the default branch was changed for new repositories in the organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization"
   },
@@ -8382,17 +12687,30 @@
     "description": "The repository self-hosted runners policy was updated",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_repo_runners_policy",
       "new_repo_runners_policy",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8403,19 +12721,32 @@
     "description": "An organization's SAML provider settings were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "sso_url",
-      "actor_id",
-      "operation_type",
       "@timestamp",
-      "issuer",
-      "org",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "sso_url",
+      "operation_type",
+      "issuer",
+      "created_at"
     ]
   },
   {
@@ -8423,18 +12754,30 @@
     "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.",
     "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement",
     "fields": [
-      "request_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "org",
-      "action",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement"
   },
@@ -8443,21 +12786,31 @@
     "description": "An organization's custom property value was manually set for the first time.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8469,21 +12822,31 @@
     "description": "An organization's custom property value was deleted.",
     "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-custom-properties-for-organization-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "definition_id",
       "property_name",
       "value",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8495,18 +12858,30 @@
     "description": "A default label was created for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "operation_type",
-      "_document_id",
-      "action",
-      "created_at",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label"
   },
@@ -8515,17 +12890,30 @@
     "description": "A default label was deleted for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label"
   },
@@ -8534,17 +12922,30 @@
     "description": "A default label was edited for repositories in an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label",
     "fields": [
-      "org",
-      "created_at",
       "@timestamp",
-      "actor",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label"
   },
@@ -8553,20 +12954,33 @@
     "description": "A domain was approved for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "org_id",
-      "business_id",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization"
   },
@@ -8575,16 +12989,31 @@
     "description": "A domain was added to an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "domain_name",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
-      "operation_type",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "domain_name",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8593,14 +13022,29 @@
     "description": "A domain was removed from an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain",
     "fields": [
-      "action",
-      "domain_name",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "domain_name",
       "operation_type",
       "created_at"
     ],
@@ -8611,16 +13055,31 @@
     "description": "A domain was verified for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "domain_name",
-      "@timestamp",
-      "user_agent",
-      "request_id",
-      "actor",
-      "action",
-      "created_at",
-      "_document_id",
-      "actor_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization"
   },
@@ -8629,16 +13088,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -8648,17 +13120,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -8668,16 +13151,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
       "created_at",
       "operation_type"
     ]
@@ -8687,20 +13183,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -8708,19 +13214,30 @@
     "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor",
-      "business_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
       "user_agent",
-      "_document_id",
       "created_at",
-      "operation_type",
-      "request_id",
-      "business"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -8729,19 +13246,30 @@
     "description": "Organization projects were disabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -8750,18 +13278,29 @@
     "description": "Organization projects were enabled for all organizations in an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards",
     "fields": [
-      "actor_id",
-      "org_id",
-      "created_at",
-      "user_id",
-      "org",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
@@ -8771,23 +13310,33 @@
     "description": "An organization role was assigned to a user or team.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About custom organization roles"
   },
@@ -8796,25 +13345,32 @@
     "description": "A custom organization role was created in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -8826,25 +13382,32 @@
     "description": "A custom organization role was deleted in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
       "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor",
-      "actor_id",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -8855,19 +13418,30 @@
     "description": "A user or team was unassigned an organization role.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "organization_role_id",
-      "organization_role_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "organization_role_id",
+      "organization_role_name",
       "created_at",
       "operation_type"
     ],
@@ -8878,26 +13452,33 @@
     "description": "A custom organization role was edited in an organization.",
     "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
       "old_role_permissions",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -8910,22 +13491,33 @@
     "description": "An organization's default project base role was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_project_base_role",
-      "new_project_base_role",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_project_base_role",
+      "new_project_base_role",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8933,20 +13525,31 @@
     "description": "An entire package was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/packages/learn-github-packages/deleting-and-restoring-a-package"
@@ -8956,23 +13559,34 @@
     "description": "A package was published or republished to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "ecosystem",
       "version_count",
       "is_republished",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -8981,21 +13595,32 @@
     "description": "A specific package version was deleted.",
     "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "package",
       "version",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "ecosystem",
       "actor_is_bot"
     ],
@@ -9006,21 +13631,34 @@
     "description": "A specific package version was published or republished to a package.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "ecosystem",
       "package",
       "version",
-      "actor_id",
-      "user_agent",
       "is_republished",
-      "actor",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -9029,20 +13667,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -9051,17 +13703,32 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9072,20 +13739,34 @@
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -9094,18 +13775,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9113,16 +13806,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9130,18 +13837,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9149,18 +13868,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9171,22 +13903,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9194,22 +13935,31 @@
     "description": "The configured restriction for access to resources via personal access tokens was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9217,18 +13967,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -9239,18 +14002,28 @@
     "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9261,18 +14034,28 @@
     "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -9283,23 +14066,34 @@
     "description": "A personal access token expiration limit was set.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "token_expiration",
       "old_token_expiration",
       "exempt_administrators",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9307,21 +14101,32 @@
     "description": "A personal access token expiration limit was unset.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "programmatic_access_type",
-      "old_token_expiration",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_token_expiration",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9329,17 +14134,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9350,18 +14168,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9373,17 +14204,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -9395,20 +14239,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was created.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9420,20 +14273,29 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9445,20 +14307,29 @@
     "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
-      "repository",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "branch",
       "created_at",
       "operation_type",
       "public_repo"
@@ -9470,40 +14341,64 @@
     "description": "A GitHub Codespaces prebuild configuration for a repository was edited.",
     "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "branch",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "branch",
+      "created_at",
+      "operation_type",
+      "public_repo"
+    ],
+    "docs_reference_titles": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
+  },
+  {
+    "action": "premium_runner.create",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
-      "public_repo"
-    ],
-    "docs_reference_titles": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds"
-  },
-  {
-    "action": "premium_runner.create",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9513,17 +14408,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9533,15 +14439,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -9551,19 +14472,30 @@
     "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "business_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "created_at",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9571,23 +14503,30 @@
     "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "created_at",
-      "actor_id",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
-      "repo",
       "action",
-      "user_agent",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "request_id",
-      "user_id",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -9595,23 +14534,30 @@
     "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_id",
-      "operation_type",
+      "@timestamp",
       "_document_id",
       "action",
-      "@timestamp",
-      "repo",
-      "org",
-      "business",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org_id",
-      "created_at",
-      "business_id"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9619,17 +14565,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9639,17 +14596,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9659,17 +14627,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9679,17 +14658,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -9699,17 +14689,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "owner",
-      "action",
-      "_document_id",
-      "request_id",
-      "user_agent",
-      "actor",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -9719,17 +14722,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9737,25 +14753,36 @@
     "description": "A project's base role was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "old_project_base_role",
       "new_project_base_role",
       "project_number",
       "public_project",
-      "business",
       "project_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9763,20 +14790,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -9786,25 +14824,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -9812,20 +14862,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9833,25 +14895,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -9859,17 +14933,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9877,17 +14964,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -9895,18 +14995,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -9915,18 +15027,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -9935,19 +15059,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -9955,17 +15090,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -9977,22 +15125,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -10000,19 +15157,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10020,17 +15188,30 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10038,18 +15219,31 @@
     "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
-      "actor_id",
-      "_document_id",
-      "request_id",
-      "team",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -10057,20 +15251,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -10078,18 +15282,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -10098,18 +15314,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -10118,16 +15346,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -10139,21 +15380,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -10161,22 +15414,32 @@
     "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
     "fields": [
-      "repo",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "name",
       "created_at",
-      "_document_id",
       "operation_type",
-      "actor",
-      "repo_id",
-      "org",
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "@timestamp",
-      "programmatic_access_type"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
   },
@@ -10185,29 +15448,34 @@
     "description": "A protected branch allowance was given to a specific user, team or integration.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "authorized_actors",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -10215,24 +15483,32 @@
     "description": "Branch protection was enabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "repo_id",
-      "user_id",
       "@timestamp",
-      "user_agent",
-      "repo",
-      "name",
-      "org_id",
-      "user",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "created_at",
       "authorized_actor_names",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -10243,21 +15519,31 @@
     "description": "Branch protection was disabled on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org",
       "actor_id",
-      "request_id",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "name",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "token_scopes",
       "required_deployments_enforcement_level",
       "merge_queue_enforcement_level",
       "create_protected"
@@ -10268,22 +15554,32 @@
     "description": "Enforcement of dismissing stale pull requests was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "dismiss_stale_reviews_on_push",
-      "org_id",
-      "action",
-      "created_at",
-      "request_id",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "dismiss_stale_reviews_on_push",
+      "created_at",
       "operation_type",
-      "actor",
-      "repo",
-      "org",
-      "name",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10291,24 +15587,34 @@
     "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "authorized_actors_only",
       "authorized_actors",
       "created_at",
-      "user_agent",
       "name",
-      "_document_id",
-      "org_id",
-      "request_id",
-      "@timestamp",
-      "actor_id",
-      "org",
-      "action",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -10316,30 +15622,37 @@
     "description": "A branch protection requirement was overridden by a repository administrator.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "reasons",
-      "@timestamp",
       "before",
       "after",
-      "actor_id",
-      "repo",
       "operation_type",
-      "user_agent",
       "branch",
       "overridden_codes",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "request_id",
       "referrer",
-      "business",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "rule_suite_id"
     ]
@@ -10349,28 +15662,36 @@
     "description": "A branch update attempt was rejected.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "operation_type",
-      "request_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "branch",
       "before",
       "overridden_codes",
       "after",
-      "action",
       "reasons",
-      "actor_id",
-      "business_id",
       "deploy_key_fingerprint",
-      "token_scopes",
-      "programmatic_access_type",
       "compliant_pull_request_ids",
       "actor_is_bot",
       "rule_suite_id"
@@ -10381,23 +15702,32 @@
     "description": "Branch protection was enforced for repository administrators.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "admin_enforced",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "name",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "action",
       "repo_id",
-      "org_id",
-      "_document_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "admin_enforced",
+      "operation_type",
+      "name",
+      "created_at"
     ]
   },
   {
@@ -10405,22 +15735,32 @@
     "description": "Branch deletion was enabled or disabled for a protected branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "operation_type",
-      "request_id",
-      "repo",
       "@timestamp",
-      "org_id",
-      "org",
-      "action",
-      "allow_deletions_enforcement_level",
       "_document_id",
-      "created_at",
-      "actor_id",
-      "user_agent",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_deletions_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10428,23 +15768,32 @@
     "description": "Force pushes were enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "actor_id",
-      "name",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo",
-      "operation_type",
-      "request_id",
-      "allow_force_pushes_enforcement_level",
-      "@timestamp",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "created_at",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "allow_force_pushes_enforcement_level",
+      "created_at"
     ]
   },
   {
@@ -10452,24 +15801,33 @@
     "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "ignore_approvals_from_contributors",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -10478,22 +15836,32 @@
     "description": "Required linear commit history was enabled or disabled for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "operation_type",
       "actor",
-      "linear_history_requirement_enforcement_level",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "linear_history_requirement_enforcement_level",
       "name",
-      "org_id",
-      "repo_id",
-      "org",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -10501,24 +15869,33 @@
     "description": "Fork syncing was enabled or disabled for a read-only branch",
     "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "lock_allows_fetch_and_merge",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10527,27 +15904,34 @@
     "description": "The enforcement of a branch lock was updated.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "enforcement_level",
       "lock_branch_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch"
   },
@@ -10556,18 +15940,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -10578,24 +15975,33 @@
     "description": "A branch name pattern was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "old_name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "old_name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -10603,25 +16009,32 @@
     "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).",
     "docs_reference_links": "N/A",
     "fields": [
-      "name",
-      "org_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
       "business_id",
-      "request_id",
-      "pull_request_reviews_enforcement_level",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "action",
-      "business",
-      "user_agent",
-      "created_at",
       "repo_id",
-      "operation_type",
-      "actor",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "pull_request_reviews_enforcement_level",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -10629,22 +16042,32 @@
     "description": "Enforcement of required code owner review was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
-      "created_at",
-      "require_code_owner_review",
-      "operation_type",
-      "name",
-      "user_agent",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "require_code_owner_review",
+      "operation_type",
+      "name"
     ]
   },
   {
@@ -10652,22 +16075,33 @@
     "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "require_last_push_approval",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
   },
@@ -10676,22 +16110,32 @@
     "description": "Enforcement of the required number of approvals before merging was updated on a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "required_approving_review_count",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "required_approving_review_count",
       "created_at",
-      "actor",
       "operation_type",
-      "user_agent",
-      "name",
-      "org_id",
-      "action",
-      "actor_id",
-      "_document_id",
-      "org",
-      "@timestamp",
-      "programmatic_access_type"
+      "name"
     ]
   },
   {
@@ -10699,25 +16143,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "user_agent",
       "@timestamp",
       "_document_id",
-      "name",
-      "repo",
       "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "business",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "required_status_checks_enforcement_level",
-      "org",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at",
+      "required_status_checks_enforcement_level"
     ]
   },
   {
@@ -10725,22 +16176,32 @@
     "description": "Enforcement of required commit signing was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "name",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "request_id",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "actor",
-      "actor_id",
-      "signature_requirement_enforcement_level",
-      "repo",
-      "user_agent",
-      "programmatic_access_type"
+      "signature_requirement_enforcement_level"
     ]
   },
   {
@@ -10748,22 +16209,32 @@
     "description": "Enforcement of required status checks was updated for a branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "created_at",
-      "repo_id",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "name",
-      "actor",
-      "repo",
       "operation_type",
-      "action",
-      "strict_required_status_checks_policy",
-      "programmatic_access_type"
+      "strict_required_status_checks_policy"
     ]
   },
   {
@@ -10771,23 +16242,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -10796,24 +16278,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -10822,20 +16315,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10844,21 +16351,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -10868,22 +16388,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10892,25 +16424,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10919,23 +16461,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
-      "created_at",
-      "key",
-      "fingerprint",
-      "actor_id",
       "actor",
-      "title",
-      "user_agent",
-      "user_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "read_only",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "key",
+      "fingerprint",
+      "title",
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -10944,18 +16497,32 @@
     "description": "A pull request was closed without being merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request"
@@ -10965,21 +16532,32 @@
     "description": "A pull request was converted to a draft.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft"
   },
@@ -10988,19 +16566,32 @@
     "description": "A pull request was created.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -11011,23 +16602,35 @@
     "description": "A review was requested on a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -11037,17 +16640,31 @@
     "description": "A pull request was marked as in progress.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11055,19 +16672,32 @@
     "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -11075,19 +16705,32 @@
     "description": "A pull request was merged.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request"
@@ -11097,21 +16740,32 @@
     "description": "A pull request was marked as ready for review.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review"
   },
@@ -11120,27 +16774,34 @@
     "description": "A pull request was rebased.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "pull_request_url",
       "pull_request_title",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -11148,23 +16809,35 @@
     "description": "A review request was removed from a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "reviewer_type",
       "reviewer",
       "reviewer_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
   },
@@ -11173,18 +16846,32 @@
     "description": "A pull request was reopened after previously being closed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ]
   },
   {
@@ -11192,19 +16879,31 @@
     "description": "A review comment was added to a pull request.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "comment_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews"
@@ -11214,20 +16913,31 @@
     "description": "A review comment on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "actor",
       "@timestamp",
       "_document_id",
-      "repo",
-      "created_at",
-      "request_id",
-      "comment_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "comment_id",
+      "operation_type"
     ]
   },
   {
@@ -11235,18 +16945,31 @@
     "description": "A review comment on a pull request was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "_document_id",
-      "@timestamp",
-      "comment_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "comment_id"
     ]
   },
   {
@@ -11254,21 +16977,33 @@
     "description": "A review on a pull request was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "pull_request_url"
     ]
   },
   {
@@ -11276,20 +17011,33 @@
     "description": "A review on a pull request was dismissed.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "pull_request_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "pull_request_url",
-      "programmatic_access_type"
+      "pull_request_url"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review"
   },
@@ -11298,19 +17046,33 @@
     "description": "A review on a pull request was submitted.",
     "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "review_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "pull_request_url",
-      "programmatic_access_type",
       "actor_is_agent"
     ],
     "docs_reference_titles": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review"
@@ -11320,22 +17082,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -11344,21 +17116,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -11367,25 +17148,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -11394,23 +17182,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -11419,24 +17215,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -11445,23 +17248,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -11471,22 +17282,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -11495,19 +17315,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -11516,24 +17349,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -11542,24 +17385,32 @@
     "description": "Autofix for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11567,24 +17418,32 @@
     "description": "Autofix for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11592,24 +17451,32 @@
     "description": "Autofix for third party tools for code scanning alerts was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11617,24 +17484,32 @@
     "description": "Autofix for third party tools for code scanning alerts was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -11642,23 +17517,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -11669,17 +17553,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -11689,17 +17585,29 @@
     "description": "Prevention of direct alert dismissal for code scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -11709,25 +17617,31 @@
     "description": "Code scanning using the default setup was disabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11736,26 +17650,34 @@
     "description": "Code scanning using the default setup was enabled for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "query_suite",
       "threat_model",
-      "languages",
-      "request_access_security_header"
+      "languages"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
   },
@@ -11764,25 +17686,34 @@
     "description": "Code scanning using the default setup was updated for a repository.",
     "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "query_suite",
       "threat_model",
       "languages",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Configuring default setup for code scanning"
@@ -11792,19 +17723,30 @@
     "description": "GitHub Codespaces was granted trusted repository access to this repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -11813,19 +17755,30 @@
     "description": "GitHub Codespaces trusted repository access to this repository was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -11833,17 +17786,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11852,15 +17818,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -11871,16 +17850,29 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "actor_id",
-      "repo",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11890,17 +17882,30 @@
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -11910,19 +17915,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11931,17 +17947,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -11950,26 +17979,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -11978,30 +18013,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -12010,21 +18050,32 @@
     "action": "repo.create_actions_secret",
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
-    "fields": [
-      "user_agent",
-      "request_id",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12033,25 +18084,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12060,23 +18119,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12084,25 +18154,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -12112,23 +18191,32 @@
     "description": "A source code archive of a repository was downloaded as a ZIP file.",
     "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "created_at",
       "operation_type",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/working-with-files/using-files/downloading-source-code-archives"
@@ -12138,24 +18226,32 @@
     "description": "The setting for immutable releases was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -12164,20 +18260,30 @@
     "description": "The setting for immutable releases was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12188,23 +18294,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -12212,21 +18328,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "visibility",
       "action",
-      "user_agent",
-      "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "programmatic_access_type"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12234,21 +18360,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -12256,22 +18392,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -12279,21 +18424,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -12301,20 +18456,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -12322,22 +18488,31 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12345,18 +18520,32 @@
     "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "visibility",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -12364,22 +18553,32 @@
     "description": "A GitHub Pages site that was previously soft-deleted was restored.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -12387,21 +18586,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12409,18 +18618,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -12429,22 +18650,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -12453,24 +18683,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -12479,23 +18717,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12503,26 +18751,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -12531,21 +18784,30 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
@@ -12554,25 +18816,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -12580,22 +18848,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -12604,25 +18882,34 @@
     "description": "A branch was renamed.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "old_branch",
-      "new_branch",
-      "default_branch",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "old_branch",
+      "new_branch",
+      "default_branch",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch"
@@ -12632,19 +18919,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -12652,17 +18950,32 @@
     "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12671,17 +18984,32 @@
     "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
-      "action",
-      "_document_id",
       "operation_type",
-      "created_at",
-      "@timestamp"
+      "created_at"
     ],
     "docs_reference_titles": "Monitoring and troubleshooting self-hosted runners"
   },
@@ -12690,7 +19018,28 @@
     "description": "The runner application was updated. This event is not included in the JSON/CSV export.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "runner_id",
       "runner_name",
       "source_version",
@@ -12705,22 +19054,30 @@
     "description": "The cache retention policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12732,22 +19089,30 @@
     "description": "The cache storage policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -12759,23 +19124,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -12785,20 +19159,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -12809,21 +19194,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -12832,22 +19228,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -12856,21 +19262,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -12879,22 +19296,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -12905,16 +19332,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -12924,22 +19362,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -12948,23 +19397,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -12974,19 +19433,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -12994,21 +19463,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -13017,24 +19496,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13042,25 +19530,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -13069,24 +19564,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13095,25 +19600,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -13122,22 +19635,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13146,26 +19668,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -13173,31 +19703,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13206,22 +19743,30 @@
     "description": "Someone closed a security advisory.",
     "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories",
     "fields": [
-      "actor",
-      "repo",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
-      "user_agent",
-      "actor_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "created_at",
-      "repo_id",
-      "_document_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "About repository security advisories"
   },
@@ -13230,18 +19775,29 @@
     "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "_document_id",
+      "operation_type",
       "created_at"
     ]
   },
@@ -13250,17 +19806,30 @@
     "description": "GitHub made a security advisory public in the GitHub Advisory Database.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ]
   },
@@ -13269,21 +19838,30 @@
     "description": "GitHub withdrew a security advisory that was published in error.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -13291,18 +19869,30 @@
     "description": "Someone opened a draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
       "repo_id",
-      "action",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13310,21 +19900,30 @@
     "description": "Someone published a security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "actor_id",
       "@timestamp",
-      "actor",
-      "repo_id",
       "_document_id",
-      "repo",
-      "business_id",
-      "business",
-      "request_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "org"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -13332,17 +19931,30 @@
     "description": "Someone reopened as draft security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "repo",
-      "action",
-      "created_at",
       "@timestamp",
-      "request_id",
-      "actor_id",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "public_repo"
     ]
   },
@@ -13351,21 +19963,30 @@
     "description": "Someone edited a draft or published security advisory.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "repo_id",
-      "org_id",
       "business",
-      "actor",
-      "user_agent",
-      "created_at",
-      "_document_id",
       "business_id",
-      "repo",
-      "action",
-      "operation_type",
+      "hashed_token",
       "org",
-      "@timestamp",
-      "request_id"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13373,24 +19994,30 @@
     "description": "Branch protections were disabled for the repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -13399,24 +20026,30 @@
     "description": "Branch protections were enabled for this repository.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
   },
@@ -13425,25 +20058,31 @@
     "description": "Code security was disabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13452,25 +20091,31 @@
     "description": "Code security was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -13479,19 +20124,30 @@
     "description": "Data use settings were disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "repo_id",
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "_document_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -13500,21 +20156,30 @@
     "description": "Data use settings were enabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "user",
-      "org",
-      "user_id",
-      "repo_id",
       "@timestamp",
-      "request_id",
-      "actor",
+      "_document_id",
       "action",
-      "operation_type",
-      "created_at",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org_id",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -13523,23 +20188,30 @@
     "description": "The dependency graph was disabled for a private repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories",
     "fields": [
-      "repo_id",
-      "operation_type",
-      "user_id",
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
-      "@timestamp",
-      "org_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea, tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories"
   },
@@ -13548,24 +20220,31 @@
     "description": "The dependency graph was enabled for a private repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor_id",
-      "repo_id",
+      "created_at",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -13574,21 +20253,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -13596,21 +20285,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13618,21 +20317,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -13640,20 +20350,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -13661,21 +20383,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13683,19 +20416,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "actor",
-      "invitee",
-      "action",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -13703,17 +20449,31 @@
     "description": "An organization has reached their repository limit.",
     "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "limit",
       "count",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -13724,17 +20484,31 @@
     "description": "An organization is approaching their repository limit.",
     "docs_reference_links": "repositories/creating-and-managing-repositories/repository-limits",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "limit",
       "count",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -13745,19 +20519,30 @@
     "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise  Organization owners can now control their repository projects settings.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise",
     "fields": [
-      "request_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
       "action",
-      "user_agent",
-      "user",
-      "business_id",
-      "business",
-      "operation_type",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for projects in your enterprise"
   },
@@ -13766,20 +20551,30 @@
     "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
       "@timestamp",
-      "repo",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "repo_id",
-      "actor",
-      "request_id",
-      "programmatic_access_type"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -13788,20 +20583,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
       "created_at",
-      "org_id",
-      "action",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "actor_id",
-      "repo"
+      "operation_type"
     ]
   },
   {
@@ -13809,31 +20613,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -13842,19 +20654,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -13862,8 +20685,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -13872,23 +20694,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -13913,26 +20744,32 @@
     "description": "Automatic partner validation checks have been disabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -13941,26 +20778,32 @@
     "description": "Automatic partner validation checks have been enabled at the repository level",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository"
   },
@@ -13969,23 +20812,30 @@
     "description": "A custom pattern was created for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -13995,23 +20845,30 @@
     "description": "A custom pattern was removed from secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14021,24 +20878,31 @@
     "description": "A custom pattern was published for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14048,24 +20912,31 @@
     "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
   },
@@ -14074,24 +20945,31 @@
     "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14101,23 +20979,30 @@
     "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.",
     "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "Defining custom patterns for secret scanning"
@@ -14127,23 +21012,31 @@
     "description": "Secret scanning was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type"
+      "public_repo"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -14152,22 +21045,30 @@
     "description": "Secret scanning was enabled for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14175,24 +21076,32 @@
     "description": "Generic secrets have been disabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14200,22 +21109,31 @@
     "description": "Generic secrets have been enabled at the repository level",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -14224,24 +21142,32 @@
     "description": "Secret scanning for non-provider patterns was disabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -14250,24 +21176,32 @@
     "description": "Secret scanning for non-provider patterns was enabled at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/secret-scanning-patterns#non-provider-patterns",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Supported secret scanning patterns"
   },
@@ -14276,19 +21210,31 @@
     "description": "A role or team was added to the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14297,24 +21243,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Specific roles or teams\" to \"Anyone with write access\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14323,24 +21277,32 @@
     "description": "Push protection settings for \"Users who can bypass push protection for secret scanning\" changed from \"Anyone with write access\" to \"Specific roles or teams\" at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14349,19 +21311,31 @@
     "description": "A role or team was removed from the push protection bypass list at the repository level.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#enabling-delegated-bypass-for-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14370,26 +21344,31 @@
     "description": "Secret scanning push protection was disabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14398,26 +21377,31 @@
     "description": "Secret scanning push protection was enabled for a repository.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -14426,28 +21410,36 @@
     "description": "A code security configuration was applied to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14455,27 +21447,35 @@
     "description": "A code security configuration failed to attach to the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14483,28 +21483,36 @@
     "description": "A code security configuration was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14512,28 +21520,36 @@
     "description": "A code security configuration was removed due to a change in repository or enterprise settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "repository_security_configuration_state",
       "repository_security_configuration_failure_reason",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14541,20 +21557,30 @@
     "description": "The repository visibility change setting was cleared for an organization or enterprise.",
     "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
       "business",
-      "action",
-      "operation_type",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "business_id",
-      "@timestamp",
       "user_agent",
-      "actor",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, Enforcing repository management policies in your enterprise"
   },
@@ -14563,20 +21589,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "org_id",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
-      "user_id",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14584,19 +21620,30 @@
     "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "operation_type",
-      "_document_id",
       "@timestamp",
-      "user_agent",
-      "user",
-      "created_at",
-      "org",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "request_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -14604,29 +21651,37 @@
     "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -14635,29 +21690,37 @@
     "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
-      "action",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "vulnerability_alert_rule_id",
-      "vulnerability_alert_rule_name",
-      "request_access_security_header"
+      "vulnerability_alert_rule_name"
     ],
     "docs_reference_titles": "About Dependabot auto-triage rules"
   },
@@ -14666,19 +21729,32 @@
     "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.",
     "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
     "fields": [
-      "operation_type",
-      "request_id",
-      "repo_id",
       "@timestamp",
-      "user_agent",
-      "alert_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "alert_id",
+      "created_at",
+      "alert_number"
     ],
     "docs_reference_titles": "About Dependabot alerts"
   },
@@ -14687,23 +21763,32 @@
     "description": "A Dependabot alert was manually dismissed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
-      "operation_type",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "operation_type",
       "alert_id",
-      "actor",
-      "repo",
       "created_at",
-      "org",
-      "_document_id",
-      "action",
-      "actor_id",
       "dismiss_reason",
-      "user",
       "dismiss_comment",
       "alert_number",
       "actor_is_bot"
@@ -14714,21 +21799,33 @@
     "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "public_repo",
       "owner",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "token_scopes",
       "alert_number"
     ]
   },
@@ -14737,26 +21834,34 @@
     "description": "A Dependabot alert was manually reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "alert_id",
-      "created_at",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "created_at",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo",
-      "alert_number",
-      "request_access_security_header"
+      "alert_number"
     ]
   },
   {
@@ -14764,21 +21869,32 @@
     "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.",
     "docs_reference_links": "N/A",
     "fields": [
-      "alert_id",
-      "repo",
-      "operation_type",
-      "action",
-      "repo_id",
-      "_document_id",
-      "user_agent",
-      "request_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "alert_number",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "alert_id",
+      "operation_type",
+      "created_at",
+      "alert_number"
     ]
   },
   {
@@ -14786,21 +21902,35 @@
     "description": "A Dependabot alert was withdrawn.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "alert_id",
       "alert_number",
       "ghsa_id",
       "created_at",
       "active",
-      "action",
-      "repository_id",
-      "repo",
-      "repo_id",
       "public_repo",
       "owner",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "operation_type"
     ]
   },
@@ -14809,20 +21939,30 @@
     "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts",
     "fields": [
-      "org",
+      "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
-      "operation_type",
-      "created_at",
-      "actor",
       "action",
-      "@timestamp",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts"
   },
@@ -14831,24 +21971,31 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -14856,26 +22003,32 @@
     "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -14883,23 +22036,30 @@
     "description": "Dependabot alerts was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "request_id",
-      "repo_id",
-      "action",
-      "actor_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "org",
-      "_document_id",
       "user_id",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -14907,23 +22067,30 @@
     "description": "Dependabot alerts was enabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_agent",
-      "created_at",
       "@timestamp",
-      "repo_id",
+      "_document_id",
       "action",
-      "user",
-      "repo",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor_id",
-      "_document_id",
-      "user_id",
-      "operation_type",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
       "actor_is_bot"
     ]
   },
@@ -14932,24 +22099,31 @@
     "description": "A status check was marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "org",
-      "actor_id",
       "@timestamp",
-      "business",
-      "request_id",
-      "context",
-      "repo_id",
-      "action",
-      "repo",
       "_document_id",
-      "operation_type",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "actor",
-      "created_at",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "context",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -14958,21 +22132,31 @@
     "description": "A status check was no longer marked as required for a protected branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
     "fields": [
-      "actor_id",
-      "actor",
-      "created_at",
-      "context",
-      "operation_type",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "repo_id",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
       "repo",
-      "programmatic_access_type"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "context",
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging"
   },
@@ -14981,18 +22165,31 @@
     "description": "Email notification restrictions for an organization or enterprise were disabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -15001,19 +22198,31 @@
     "description": "Email notification restrictions for an organization or enterprise were enabled.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "business_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Restricting email notifications for your organization, Restricting email notifications for your enterprise"
   },
@@ -15022,22 +22231,33 @@
     "description": "A new custom repository role was created.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "name",
-      "owner",
-      "base_role",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "owner",
+      "base_role",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "role_permissions",
       "old_role_permissions"
     ],
@@ -15048,23 +22268,34 @@
     "description": "A custom repository role was deleted.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Managing custom repository roles for an organization"
   },
@@ -15073,23 +22304,34 @@
     "description": "A custom repository role was edited.",
     "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "owner",
       "role_permissions",
       "base_role",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "old_role_permissions",
       "old_base_role"
     ],
@@ -15100,14 +22342,28 @@
     "description": "A user was assigned to a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15122,14 +22378,28 @@
     "description": "GitHub detected a secret and created a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15143,14 +22413,28 @@
     "description": "A secret scanning alert was deleted by GitHub.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15166,14 +22450,28 @@
     "description": "A secret scanning alert was leaked in a public repo.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15188,22 +22486,32 @@
     "description": "A secret scanning alert was reopened.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type_display_name"
     ]
   },
@@ -15212,14 +22520,28 @@
     "description": "A leaked secret was reported to the secret's provider by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "created_at",
@@ -15234,28 +22556,37 @@
     "description": "A secret scanning alert was resolved.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "number",
-      "resolution",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
+      "resolution",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "token_scopes",
       "secret_type",
       "secret_type_display_name",
       "publicly_leaked",
-      "multi_repo",
-      "request_access_security_header"
+      "multi_repo"
     ]
   },
   {
@@ -15263,25 +22594,32 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
-      "number",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -15289,14 +22627,28 @@
     "description": "A user was unassigned from a secret scanning alert.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "secret_type",
       "secret_type_display_name",
@@ -15311,14 +22663,28 @@
     "description": "A secret scanning alert was validated.",
     "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "previous_validity",
@@ -15335,26 +22701,34 @@
     "description": "A request to close a secret scanning alert was approved by a user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "request_reviewer_comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15363,25 +22737,33 @@
     "description": "N/A",
     "docs_reference_links": "A reqeust to close a secret scanning alert was canceled by a user.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "A, reqeust, to, close, a, secret, scanning, alert, was, canceled, by, a, user."
@@ -15391,27 +22773,35 @@
     "description": "N/A",
     "docs_reference_links": "A user requested to close a secret scanning alert.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "reason",
       "comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "A, user, requested, to, close, a, secret, scanning, alert."
@@ -15421,26 +22811,34 @@
     "description": "A request to close a secret scanning alert was denied by a user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "alert_number",
       "request_reviewer_comment",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15449,19 +22847,30 @@
     "description": "Secret scanning was disabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15470,19 +22879,30 @@
     "description": "Secret scanning was enabled for all existing repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15491,20 +22911,30 @@
     "description": "Secret scanning was disabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "actor_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15513,19 +22943,30 @@
     "description": "Secret scanning was enabled for all new repositories.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "About secret scanning"
   },
@@ -15534,14 +22975,28 @@
     "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.",
     "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret",
     "fields": [
-      "repo_id",
-      "repo",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "org_id",
-      "org",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "number",
       "created_at",
       "push_protection_bypass_reason",
@@ -15559,25 +23014,33 @@
     "description": "A request to bypass secret scanning push protection was approved by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "About push protection"
   },
@@ -15586,24 +23049,32 @@
     "description": "A user canceled a request to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
@@ -15613,24 +23084,32 @@
     "description": "A user pushed a commit containing a secret for which there is an approved secret scanning push protection bypass request.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
@@ -15640,25 +23119,33 @@
     "description": "A request to bypass secret scanning push protection was denied by a user.",
     "docs_reference_links": "/code-security/secret-scanning/push-protection-for-repositories-and-organizations#managing-requests-to-bypass-push-protection",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
-      "request_access_security_header",
       "request_reviewer_comment"
     ],
     "docs_reference_titles": "About push protection"
@@ -15668,25 +23155,33 @@
     "description": "A user requested to bypass secret scanning push protection.",
     "docs_reference_links": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/code-security/secret-scanning/working-with-push-protection#requesting-bypass-privileges-when-working-with-the-command-line"
   },
@@ -15695,22 +23190,35 @@
     "description": "A secret scanning scan has completed on this repository.",
     "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning",
     "fields": [
-      "repo_id",
-      "org_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "source",
       "type",
       "source_slug",
       "type_slug",
       "started_at",
       "completed_at",
-      "repo",
       "public_repo",
-      "org",
-      "business",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "secret_types",
@@ -15724,10 +23232,28 @@
     "description": "A security configuration was created",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15742,15 +23268,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15768,22 +23287,33 @@
     "description": "A default security configuration setting for new repositories was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15792,22 +23322,33 @@
     "description": "A default security configuration setting for new repositories was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "default_for_new_private_repos",
       "default_for_new_public_repos",
       "security_configuration_name",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -15816,10 +23357,28 @@
     "description": "A security configuration was deleted",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15834,15 +23393,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15859,15 +23411,30 @@
     "description": "A security configuration policy was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "enforcement",
       "security_configuration_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15877,10 +23444,28 @@
     "description": "A security configuration was updated",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "security_configuration_id",
       "security_configuration_name",
       "security_configuration_description",
@@ -15895,15 +23480,8 @@
       "security_configuration_secret_scanning",
       "security_configuration_secret_scanning_push_protection",
       "security_configuration_secret_scanning_validity_checks",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot",
       "security_configuration_dependency_graph_autosubmit_action",
       "security_configuration_secret_scanning_non_provider_patterns",
@@ -15921,16 +23499,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15940,18 +23531,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -15960,16 +23564,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -15979,15 +23596,28 @@
     "description": "An agreement for invoiced billing for GitHub Sponsors was signed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "org_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ],
@@ -15999,15 +23629,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -16017,15 +23660,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -16034,17 +23692,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -16053,17 +23724,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -16072,16 +23757,29 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
@@ -16091,14 +23789,29 @@
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -16108,17 +23821,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -16127,17 +23853,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -16146,18 +23885,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16166,15 +23918,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -16184,16 +23950,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
+      "user_id",
       "user_agent",
-      "operation_type",
-      "_document_id",
-      "actor",
-      "actor_id",
-      "user_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -16201,15 +23980,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -16220,16 +24012,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -16239,17 +24044,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -16260,17 +24078,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -16281,18 +24112,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16302,16 +24144,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16321,16 +24176,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -16342,17 +24210,30 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
-      "openssh_public_key",
-      "org_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "request_id"
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16361,19 +24242,32 @@
     "description": "An SSH certificate authority for an organization or enterprise was deleted.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "fingerprint",
-      "operation_type",
+      "action",
       "actor",
-      "org_id",
-      "openssh_public_key",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "action",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "@timestamp",
-      "request_id"
+      "created_at",
+      "fingerprint",
+      "operation_type",
+      "openssh_public_key"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16382,21 +24276,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "request_id",
-      "org",
-      "org_id",
-      "created_at",
-      "actor",
-      "action",
-      "user_id",
-      "business",
-      "business_id",
-      "@timestamp",
-      "actor_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16405,19 +24308,30 @@
     "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.",
     "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise",
     "fields": [
-      "actor_id",
-      "user_id",
-      "org",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
-      "actor",
-      "user",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "created_at",
-      "user_agent"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing your organization's SSH certificate authorities, Enforcing policies for security settings in your enterprise"
   },
@@ -16426,15 +24340,28 @@
     "description": "Dependabot encrypted config was read.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "public_repo"
@@ -16445,20 +24372,34 @@
     "description": "The verification code expiry time for an organization or enterprise domain was set.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner_type",
       "domain_name",
-      "business_id",
       "token_expires_at",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16466,18 +24407,33 @@
     "description": "An organization or enterprise domain was unverified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "owner_type",
       "domain_name",
       "owner",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "operation_type"
     ]
   },
   {
@@ -16485,16 +24441,31 @@
     "description": "An organization or enterprise domain was verified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "domain_name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -16502,23 +24473,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16526,23 +24507,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16550,23 +24541,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16574,23 +24575,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -16598,21 +24609,31 @@
     "description": "A member of an organization was added to a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org_id",
-      "user_id",
-      "team",
-      "user",
       "@timestamp",
-      "actor_id",
-      "created_at",
-      "operation_type",
       "_document_id",
-      "org",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "created_at",
+      "operation_type",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team"
@@ -16622,22 +24643,31 @@
     "description": "A team was given access and permissions to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "team",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "actor_id",
-      "_document_id",
       "repo_id",
-      "user_agent",
-      "org_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -16646,20 +24676,30 @@
     "description": "A team was added to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team_type",
       "team",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -16670,20 +24710,31 @@
     "description": "A child team was created or a child team's parent was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy",
     "fields": [
-      "org",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "team",
       "action",
-      "operation_type",
       "actor",
-      "request_id",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy"
   },
@@ -16692,18 +24743,31 @@
     "description": "A team's privacy level was changed.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility",
     "fields": [
-      "user_agent",
-      "request_id",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team",
       "created_at",
       "operation_type",
-      "actor_id",
-      "org_id",
-      "@timestamp",
-      "actor",
-      "_document_id",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/changing-team-visibility"
@@ -16713,21 +24777,32 @@
     "description": "A new team is created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "oauth_application_id",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "oauth_application_id",
+      "operation_type",
       "team",
-      "org",
-      "actor",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -16736,21 +24811,31 @@
     "description": "A user was demoted from a team maintainer to a team member.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
   },
@@ -16759,19 +24844,31 @@
     "description": "A team was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "team",
       "org_id",
-      "actor_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "team",
       "operation_type",
-      "_document_id",
-      "programmatic_access_type",
       "team_type"
     ]
   },
@@ -16780,19 +24877,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "business_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
       "business",
-      "action",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16800,19 +24908,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "operation_type",
-      "request_id",
       "actor",
-      "org",
-      "created_at",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
-      "_document_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16820,18 +24939,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
       "@timestamp",
-      "action",
       "_document_id",
-      "user_agent",
-      "user_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "business",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -16840,19 +24970,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "actor",
-      "action",
-      "operation_type",
-      "team",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -16860,19 +25002,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "actor_id",
       "_document_id",
-      "team",
-      "created_at",
-      "org_id",
       "action",
-      "request_id",
-      "user_agent",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "request_access_security_header"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "team",
+      "created_at"
     ]
   },
   {
@@ -16880,22 +25034,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "team",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -16903,22 +25066,31 @@
     "description": "A user was promoted from a team member to a team maintainer.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "team",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "team",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer"
   },
@@ -16927,20 +25099,30 @@
     "description": "A team was removed from an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "team_type",
       "team",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -16951,22 +25133,31 @@
     "description": "An organization member was removed from a team.",
     "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team",
     "fields": [
-      "request_id",
-      "operation_type",
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "team",
-      "user_id",
-      "actor",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
+      "operation_type",
+      "created_at",
+      "team",
       "team_type"
     ],
     "docs_reference_titles": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team"
@@ -16976,43 +25167,64 @@
     "description": "A repository was removed from a team's control.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "org_id",
-      "repo",
-      "repo_id",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "created_at",
       "team",
-      "org",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
     "action": "team.rename",
-    "description": "A team's name was changed.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "name",
-      "user_agent",
-      "created_at",
-      "team",
-      "operation_type",
-      "actor_id",
-      "org",
+    "description": "A team's name was changed.",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "_document_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "created_at",
+      "team",
+      "operation_type",
       "team_type"
     ]
   },
@@ -17021,17 +25233,30 @@
     "description": "Team synchronization with a tenant was disabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "request_id",
-      "org_id",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -17040,19 +25265,30 @@
     "description": "Team synchronization with a tenant was enabled.",
     "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise",
     "fields": [
-      "org_id",
-      "business_id",
-      "actor",
-      "created_at",
-      "user_agent",
       "@timestamp",
-      "operation_type",
-      "business",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing team synchronization for your organization, Managing team synchronization for organizations in your enterprise"
   },
@@ -17061,19 +25297,30 @@
     "description": "The Okta credentials for team synchronization with a tenant were changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -17081,28 +25328,37 @@
     "description": "A team's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "team",
-      "org_id",
       "@timestamp",
-      "org",
       "_document_id",
-      "old_permission",
-      "request_id",
-      "repo",
       "action",
-      "repo_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "team",
+      "old_permission",
       "operation_type",
       "created_at",
-      "user_agent",
       "permission",
       "new_repo_permission",
       "new_repo_base_role",
       "old_repo_permission",
-      "old_repo_base_role",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_repo_base_role"
     ]
   },
   {
@@ -17110,23 +25366,38 @@
     "description": "Triggered when a user content edit is deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_content_id",
       "user_content_type",
       "created_at",
-      "user_agent",
       "deleted_by",
       "editor_id",
-      "_document_id",
       "deleted_at",
-      "action",
-      "actor_id",
       "editor",
       "deleted_by_id",
       "deleted_content",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -17134,16 +25405,30 @@
     "description": "A Dependabot rule was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17153,16 +25438,30 @@
     "description": "A Dependabot rule was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17172,18 +25471,31 @@
     "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17193,21 +25505,33 @@
     "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_id",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17215,21 +25539,32 @@
     "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -17237,21 +25572,32 @@
     "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "org",
-      "org_id",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -17259,16 +25605,30 @@
     "description": "A Dependabot rule's conditions, actions, or metadata changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "vulnerability_alert_rule_id",
       "vulnerability_alert_rule_name",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17278,27 +25638,33 @@
     "description": "A workflow job was approved.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -17307,23 +25673,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -17331,10 +25707,28 @@
     "description": "A workflow run was cancelled.",
     "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17345,20 +25739,9 @@
       "run_number",
       "cancelled_at",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Canceling a workflow run"
   },
@@ -17367,23 +25750,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -17393,10 +25784,28 @@
     "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17408,19 +25817,9 @@
       "conclusion",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
-      "programmatic_access_type",
       "actor_is_bot",
       "actor_is_agent"
     ],
@@ -17431,10 +25830,28 @@
     "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17443,21 +25860,10 @@
       "head_branch",
       "head_sha",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot",
-      "request_access_security_header",
       "actor_is_agent"
     ],
     "docs_reference_titles": "Understanding GitHub Actions"
@@ -17467,23 +25873,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -17492,22 +25910,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -17515,21 +25944,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -17537,25 +25977,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -17563,23 +26011,36 @@
     "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows",
     "fields": [
-      "repo_id",
-      "repo",
-      "org_id",
-      "org",
-      "business_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "job_name",
       "runner_labels",
       "is_hosted_runner",
       "environment_name",
       "secrets_passed",
-      "action",
-      "_document_id",
       "operation_type",
       "created_at",
-      "@timestamp",
       "runner_owner_type",
       "job_workflow_ref",
       "calling_workflow_refs",
@@ -17593,24 +26054,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -17619,10 +26089,28 @@
     "description": "A workflow run was re-run.",
     "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "started_at",
       "event",
@@ -17632,21 +26120,11 @@
       "head_sha",
       "run_number",
       "workflow_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "business",
-      "business_id",
       "trigger_id",
       "run_attempt",
       "rerun_type",
       "check_run_id",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "Re-running workflows and jobs"
@@ -17656,25 +26134,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/data/ghes-3.20/user.json b/src/audit-logs/data/ghes-3.20/user.json
index d3296f6f9bf4..554d93629caf 100644
--- a/src/audit-logs/data/ghes-3.20/user.json
+++ b/src/audit-logs/data/ghes-3.20/user.json
@@ -4,17 +4,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
       "@timestamp",
-      "operation_type",
-      "user_agent",
       "_document_id",
-      "created_at",
       "action",
-      "request_id",
       "actor",
       "actor_id",
-      "org_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -22,18 +35,30 @@
     "description": "The account's plan changed.",
     "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
     "fields": [
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
       "user_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "How GitHub billing works"
   },
@@ -42,17 +67,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
-      "user_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -61,18 +98,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
+      "token_scopes",
       "user",
-      "request_id",
-      "_document_id",
-      "user_agent",
-      "actor",
       "user_id",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -80,18 +129,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
-      "actor_id",
-      "operation_type",
-      "created_at",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "token_id"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -99,29 +160,35 @@
     "description": "A GitHub Actions cache was deleted using the REST API.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "user_id",
-      "user",
-      "repo_id",
-      "repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "actions_cache_id",
       "actions_cache_key",
       "actions_cache_version",
       "actions_cache_scope",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -129,18 +196,30 @@
     "description": "A workflow run artifact was manually deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -148,21 +227,34 @@
     "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
@@ -178,22 +270,34 @@
     "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "uuid",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -201,25 +305,37 @@
     "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "customer_id",
       "target_amount",
       "target_type",
       "target_id",
       "alert_enabled",
       "status",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
-      "request_access_security_header",
       "old_target_amount",
       "old_budget_limit_type",
       "old_alert_enabled",
@@ -233,17 +349,30 @@
     "description": "The way the account pays for GitHub was changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
     "fields": [
-      "actor_id",
-      "user",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "created_at",
-      "operation_type",
-      "_document_id",
       "user_agent",
-      "request_id"
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -252,19 +381,31 @@
     "description": "The billing email address changed.",
     "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "operation_type",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "@timestamp",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "_document_id",
-      "org",
-      "email",
-      "action",
-      "request_access_security_header"
+      "email"
     ],
     "docs_reference_titles": "Managing your payment and billing information"
   },
@@ -273,15 +414,28 @@
     "description": "Azure subscription has been linked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -291,15 +445,28 @@
     "description": "Azure subscription has been unlinked on this account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -309,18 +476,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
       "@timestamp",
-      "actor_id",
-      "operation_type",
       "_document_id",
-      "request_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "created_at",
-      "action"
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -328,16 +508,28 @@
     "description": "The premium request paid usage policy for your GitHub account was changed.",
     "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -349,18 +541,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
-      "user_agent",
-      "created_at",
       "user_id",
-      "request_id",
-      "actor",
-      "action",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -368,15 +572,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -386,26 +603,36 @@
     "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -413,24 +640,34 @@
     "description": "A CSV export was requested on the \"Coverage\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -438,26 +675,36 @@
     "description": "A CSV export was requested on the \"Overview Dashboard\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
-      "user",
-      "user_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -465,20 +712,31 @@
     "description": "A CSV export was requested on the \"Risk\" page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -489,17 +747,29 @@
     "description": "The cache retention policy for GitHub Actions was set for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -511,17 +781,29 @@
     "description": "The cache storage policy for GitHub Actions was set for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -533,17 +815,30 @@
     "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -554,20 +849,32 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "policy",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -576,19 +883,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "limit",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -597,19 +917,31 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -618,20 +950,32 @@
     "description": "The policy for fork pull request workflows was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "policy",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -640,19 +984,31 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
     "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
   },
@@ -661,20 +1017,31 @@
     "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "visibility",
-      "user_agent",
-      "user",
       "@timestamp",
-      "repo",
-      "actor_id",
-      "user_id",
+      "_document_id",
       "action",
-      "created_at",
       "actor",
-      "operation_type",
-      "request_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
   },
@@ -683,20 +1050,31 @@
     "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
     "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo"
     ],
     "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
@@ -707,17 +1085,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "user_agent",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repo",
-      "programmatic_access_type"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -725,14 +1115,29 @@
     "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "origin_repository",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -742,25 +1147,34 @@
     "description": "Credentials for a codespace were refreshed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
-      "pull_request_id",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "org_id",
+      "user_agent",
+      "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -771,22 +1185,33 @@
     "description": "A codespace was created",
     "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot",
       "machine_type",
       "devcontainer_path"
@@ -798,22 +1223,33 @@
     "description": "A user deleted a codespace.",
     "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repository_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "pull_request_id",
       "owner",
       "name",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Deleting a codespace"
   },
@@ -822,15 +1258,30 @@
     "description": "A codespace was exported to a branch on GitHub.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "owner",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "public_repo"
@@ -841,17 +1292,30 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -861,27 +1325,36 @@
     "description": "A codespace was started.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "owner",
-      "pull_request_id",
-      "machine_type",
-      "user_id",
-      "user",
-      "devcontainer_path",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "owner",
+      "pull_request_id",
+      "machine_type",
+      "devcontainer_path",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -889,19 +1362,32 @@
     "description": "A codespace was stopped.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "public_repo"
     ]
   },
   {
@@ -909,18 +1395,30 @@
     "description": "A personal account's access and security setting for Codespaces were updated.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
       "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -929,23 +1427,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -953,16 +1458,30 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
     "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "What is GitHub Copilot?"
   },
@@ -971,24 +1490,30 @@
     "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -996,15 +1521,28 @@
     "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1014,20 +1552,30 @@
     "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1035,19 +1583,31 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "seat_assignment",
-      "request_access_security_header"
+      "seat_assignment"
     ]
   },
   {
@@ -1055,21 +1615,30 @@
     "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1077,22 +1646,33 @@
     "description": "Specific repositories were disabled from using Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org_id",
-      "owner_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "owner",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -1100,21 +1680,31 @@
     "description": "Specific repositories were enabled to use Copilot coding agent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "owner_type",
-      "owner",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner_type",
+      "owner",
       "public_repo",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1124,20 +1714,32 @@
     "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_access",
       "old_access",
-      "org_id",
       "owner_type",
       "owner",
-      "org",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -1147,21 +1749,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1171,19 +1782,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -1193,21 +1813,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "runner_group_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1217,19 +1846,30 @@
     "description": "Dependabot alerts were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1238,19 +1878,30 @@
     "description": "Dependabot alerts were enabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
   },
@@ -1259,19 +1910,30 @@
     "description": "Dependabot alerts were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1280,19 +1942,30 @@
     "description": "Dependabot alerts were enabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
   },
@@ -1301,17 +1974,30 @@
     "description": "The repositories that Dependabot can access were updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1319,19 +2005,30 @@
     "description": "Dependabot security updates were disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1340,19 +2037,30 @@
     "description": "Dependabot security updates were enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1360,19 +2068,30 @@
     "description": " Dependabot security updates were disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1381,19 +2100,30 @@
     "description": "Dependabot security updates were enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -1401,19 +2131,30 @@
     "description": "The dependency graph was disabled for all existing repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1422,19 +2163,30 @@
     "description": "The dependency graph was enabled for all existing repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1442,19 +2194,30 @@
     "description": "The dependency graph was disabled for all new repositories.",
     "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
   },
@@ -1463,20 +2226,30 @@
     "description": "The dependency graph was enabled for all new repositories.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1484,22 +2257,31 @@
     "description": "A GitHub Actions deployment protection rule was created via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1508,22 +2290,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "environment_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "environment_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1531,28 +2323,34 @@
     "description": "A secret was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "oauth_application_id",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1561,27 +2359,35 @@
     "description": "A variable was created for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1590,25 +2396,33 @@
     "description": "An environment was deleted.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1617,26 +2431,33 @@
     "description": "A secret was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "public_repo",
-      "token_scopes",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1645,21 +2466,33 @@
     "description": "A variable was deleted for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1668,49 +2501,68 @@
     "description": "A GitHub Actions deployment protection rule was deleted via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "name",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "public_repo",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "Managing environments for deployment"
-  },
-  {
-    "action": "environment.update_actions_secret",
-    "description": "A secret was updated for a GitHub Actions environment.",
-    "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
-    "fields": [
-      "user_agent",
-      "request_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "operation_type",
-      "@timestamp",
       "created_at",
+      "public_repo"
+    ],
+    "docs_reference_titles": "Managing environments for deployment"
+  },
+  {
+    "action": "environment.update_actions_secret",
+    "description": "A secret was updated for a GitHub Actions environment.",
+    "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
+    "fields": [
+      "@timestamp",
       "_document_id",
-      "public_repo",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "visibility",
+      "operation_type",
+      "created_at",
+      "public_repo"
     ],
     "docs_reference_titles": "Managing environments for deployment"
   },
@@ -1719,22 +2571,34 @@
     "description": "A variable was updated for a GitHub Actions environment.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "environment_name",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -1743,21 +2607,31 @@
     "description": "A GitHub Actions deployment protection rule was updated via the API.",
     "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_value",
       "approvers_was",
       "approvers",
-      "programmatic_access_type",
       "can_admins_bypass",
       "prevent_self_review"
     ],
@@ -1768,21 +2642,32 @@
     "description": "A gist was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "gist_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "user_agent",
-      "actor",
-      "actor_id",
-      "visibility",
-      "action",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ]
   },
   {
@@ -1790,20 +2675,32 @@
     "description": "A gist was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "gist_id",
-      "visibility",
-      "created_at",
+      "@timestamp",
       "_document_id",
-      "user",
-      "request_id",
-      "operation_type",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "programmatic_access_type"
+      "gist_id",
+      "visibility",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1811,21 +2708,32 @@
     "description": "The visibility of a gist was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "user",
-      "gist_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "visibility",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "gist_id",
+      "visibility",
+      "created_at"
     ]
   },
   {
@@ -1833,22 +2741,33 @@
     "description": "An SSH key was added to a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1857,23 +2776,34 @@
     "description": "An SSH key was removed from a user account as a Git commit signing key.",
     "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
-      "user_id",
       "explanation",
-      "user",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
   },
@@ -1882,23 +2812,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -1906,18 +2845,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -1928,20 +2877,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
-      "runner_group_id",
       "business",
-      "user",
-      "user_id",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
       "created_at",
       "operation_type"
     ]
@@ -1951,18 +2910,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "created_at",
-      "user_id",
       "@timestamp",
-      "user",
-      "operation_type",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -1970,18 +2941,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "created_at",
-      "_document_id",
+      "user_id",
       "user_agent",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -1989,25 +2972,35 @@
     "description": "A hook's active status was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "name",
       "events",
       "active",
       "active_was",
       "hook_id",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -2015,25 +3008,34 @@
     "description": "A hook's configuration was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "user_agent",
-      "request_id",
-      "hook_id",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "name",
+      "hook_id",
       "created_at",
       "oauth_application_id",
-      "action",
-      "events",
-      "org_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "events"
     ]
   },
   {
@@ -2041,26 +3043,35 @@
     "description": "A new hook was added.",
     "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
     "fields": [
-      "oauth_application",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "hook_id",
       "events",
-      "repo",
-      "@timestamp",
       "operation_type",
       "name",
-      "action",
-      "created_at",
-      "org_id",
-      "org",
-      "token_scopes",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "About webhooks"
   },
@@ -2069,25 +3080,34 @@
     "description": "A hook was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "created_at",
-      "org",
       "name",
-      "request_id",
-      "actor_id",
-      "repo_id",
-      "org_id",
-      "action",
       "operation_type",
       "oauth_application_id",
-      "user_agent",
-      "hook_id",
-      "@timestamp",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "hook_id"
     ]
   },
   {
@@ -2095,26 +3115,35 @@
     "description": "A hook's configured events were changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "events",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "events",
       "operation_type",
-      "action",
-      "_document_id",
-      "actor_id",
       "name",
       "events_were",
-      "@timestamp",
       "created_at",
       "hook_id",
-      "repo_id",
-      "org_id",
-      "org",
-      "user_agent",
-      "request_id",
-      "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type"
+      "oauth_application_id"
     ]
   },
   {
@@ -2122,21 +3151,32 @@
     "description": "A GitHub App was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "_document_id",
+      "user_agent",
+      "operation_type",
+      "name",
       "integration",
       "created_at",
-      "programmatic_access_type",
-      "request_access_security_header",
       "application_client_id"
     ]
   },
@@ -2145,19 +3185,32 @@
     "description": "A GitHub App was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "integration",
-      "user",
-      "_document_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user_agent"
+      "created_at"
     ]
   },
   {
@@ -2165,21 +3218,32 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
       "business",
       "business_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
+      "integration",
+      "operation_type",
+      "created_at",
       "application_client_id"
     ]
   },
@@ -2188,19 +3252,33 @@
     "description": "A GitHub App was installed.",
     "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
     "fields": [
-      "operation_type",
       "@timestamp",
-      "name",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "repository_selection",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
       "user_agent",
-      "user",
+      "operation_type",
+      "name",
+      "repository_selection",
       "created_at",
       "integration",
-      "_document_id",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
@@ -2211,20 +3289,32 @@
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "_document_id",
       "repository_selection",
       "integration",
-      "user_id",
-      "user",
-      "action",
       "operation_type",
       "name",
-      "actor_id",
-      "user_agent",
-      "programmatic_access_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
@@ -2234,24 +3324,35 @@
     "description": "Repositories were added to a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "repository_selection",
       "name",
-      "user",
-      "request_id",
       "integration",
       "operation_type",
-      "actor_id",
-      "action",
       "repositories_added",
       "created_at",
-      "_document_id",
-      "@timestamp",
-      "actor",
-      "user_agent",
-      "token_scopes",
       "repositories_added_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2262,23 +3363,35 @@
     "description": "Repositories were removed from a GitHub App.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor",
+      "operation_type",
       "repository_selection",
       "repositories_removed",
       "integration",
-      "user_id",
       "created_at",
-      "_document_id",
-      "request_id",
-      "@timestamp",
       "name",
-      "action",
-      "actor_id",
       "repositories_removed_names",
-      "programmatic_access_type",
       "actor_is_bot",
       "application_client_id"
     ],
@@ -2289,42 +3402,69 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
     "fields": [
-      "user_agent",
-      "request_id",
-      "name",
-      "repository_selection",
-      "actor_id",
-      "integration",
-      "user",
-      "user_id",
-      "action",
-      "operation_type",
       "@timestamp",
-      "created_at",
       "_document_id",
-      "request_access_security_header",
-      "application_client_id"
-    ],
-    "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
-  },
-  {
-    "action": "integration_installation.unsuspend",
-    "description": "A GitHub App was unsuspended.",
-    "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
-    "fields": [
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "repository_selection",
-      "actor_id",
       "integration",
+      "operation_type",
+      "created_at",
+      "application_client_id"
+    ],
+    "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
+  },
+  {
+    "action": "integration_installation.unsuspend",
+    "description": "A GitHub App was unsuspended.",
+    "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "repository_selection",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
   },
@@ -2333,20 +3473,33 @@
     "description": "Permissions for a GitHub App were updated.",
     "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
     "fields": [
-      "integration",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "integration",
       "name",
-      "user",
       "operation_type",
-      "actor_id",
-      "action",
-      "_document_id",
-      "request_id",
       "created_at",
       "repository_selection",
-      "@timestamp",
-      "actor",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
@@ -2356,20 +3509,33 @@
     "description": "A member of an enterprise or organization was added as a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
     "fields": [
-      "created_at",
-      "action",
+      "@timestamp",
       "_document_id",
-      "name",
-      "org_id",
-      "manager",
-      "operation_type",
+      "action",
       "actor",
-      "integration",
-      "org",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_agent"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "name",
+      "manager",
+      "operation_type",
+      "integration"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
   },
@@ -2378,20 +3544,33 @@
     "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "integration",
-      "org_id",
-      "_document_id",
-      "action",
-      "actor",
       "name",
       "created_at",
-      "manager",
-      "@timestamp"
+      "manager"
     ],
     "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
   },
@@ -2400,20 +3579,32 @@
     "description": "A client secret for a GitHub App was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2421,19 +3612,32 @@
     "description": "All user tokens for a GitHub App were requested to be revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2442,19 +3646,32 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "name",
-      "integration",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "name",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "application_client_id"
     ]
   },
@@ -2463,19 +3680,32 @@
     "description": "A GitHub App was suspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type",
+      "user_agent",
+      "name",
+      "integration",
+      "created_at",
+      "operation_type",
       "application_client_id"
     ],
     "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
@@ -2486,21 +3716,34 @@
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "name",
       "transfer_to_id",
-      "user",
       "requester",
-      "action",
       "requester_id",
-      "actor_id",
       "created_at",
-      "_document_id",
-      "user_agent",
       "transfer_to",
       "operation_type",
-      "request_id",
-      "actor",
       "integration",
       "transfer_from",
       "transfer_from_id",
@@ -2514,17 +3757,30 @@
     "description": "A GitHub App was unsuspended.",
     "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "name",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "name",
+      "integration",
       "created_at",
       "operation_type",
       "application_client_id"
@@ -2536,20 +3792,30 @@
     "description": "An issue was marked as blocked by another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2560,19 +3826,30 @@
     "description": "The blocked by relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2582,20 +3859,30 @@
     "description": "An issue was marked as blocking another issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2606,20 +3893,30 @@
     "description": "The blocking relationship between an issue and another issue was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -2630,18 +3927,30 @@
     "description": "The GitHub Marketplace Developer Agreement was signed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "operation_type",
-      "created_at",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -2649,21 +3958,34 @@
     "description": "A listing was approved for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "secondary_category",
-      "actor",
-      "primary_category",
-      "user",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
+      "secondary_category",
+      "primary_category",
       "operation_type",
       "created_at",
-      "request_id",
-      "actor_id",
       "marketplace_listing",
-      "integration",
-      "action"
+      "integration"
     ]
   },
   {
@@ -2671,21 +3993,34 @@
     "description": "A category for a listing for an app in GitHub Marketplace was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
-      "user_agent",
-      "request_id",
-      "actor",
-      "marketplace_listing",
       "@timestamp",
-      "integration",
-      "org_id",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "primary_category",
+      "marketplace_listing",
+      "integration",
       "secondary_category",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2693,22 +4028,35 @@
     "description": "A listing for an app in GitHub Marketplace was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "primary_category",
+      "@timestamp",
       "_document_id",
-      "user",
-      "created_at",
-      "user_agent",
-      "oauth_application",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "marketplace_listing",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "primary_category",
+      "created_at",
+      "oauth_application",
+      "marketplace_listing",
       "secondary_category",
       "oauth_application_id",
-      "actor",
-      "actor_id",
-      "operation_type",
-      "@timestamp"
+      "operation_type"
     ]
   },
   {
@@ -2716,19 +4064,32 @@
     "description": "A listing was removed from GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "org",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "secondary_category",
       "operation_type",
       "marketplace_listing",
-      "action",
-      "@timestamp",
-      "_document_id",
       "primary_category",
       "integration"
     ]
@@ -2739,21 +4100,36 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "actor",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
       "marketplace_listing",
       "has_free_trial",
-      "user_agent",
-      "request_id",
-      "actor_id",
       "yearly_price_in_cents",
       "description",
       "bullets",
       "monthly_price_in_cents",
-      "marketplace_listing_plan",
-      "_document_id"
+      "marketplace_listing_plan"
     ]
   },
   {
@@ -2761,22 +4137,37 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "marketplace_listing_plan",
       "marketplace_listing",
       "description",
       "bullets",
       "has_free_trial",
       "created_at",
-      "actor_id",
       "operation_type",
-      "_document_id",
-      "action",
-      "user_agent",
-      "request_id",
-      "actor",
       "monthly_price_in_cents",
-      "yearly_price_in_cents",
-      "@timestamp"
+      "yearly_price_in_cents"
     ]
   },
   {
@@ -2784,21 +4175,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "marketplace_listing_plan",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "marketplace_listing_plan",
       "description",
       "yearly_price_in_cents",
-      "@timestamp",
       "created_at",
-      "actor_id",
       "bullets",
       "has_free_trial",
       "marketplace_listing",
-      "user_agent",
       "monthly_price_in_cents",
-      "action",
       "operation_type"
     ]
   },
@@ -2807,21 +4213,36 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "monthly_price_in_cents",
-      "marketplace_listing",
+      "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "monthly_price_in_cents",
+      "marketplace_listing",
       "description",
       "bullets",
       "yearly_price_in_cents",
-      "request_id",
-      "actor_id",
       "has_free_trial",
       "marketplace_listing_plan",
-      "user_agent",
-      "@timestamp",
       "operation_type",
-      "actor",
       "created_at"
     ]
   },
@@ -2830,22 +4251,35 @@
     "description": "A listing was sent back to draft state.",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "secondary_category",
-      "oauth_application_id",
       "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "secondary_category",
+      "oauth_application_id",
       "operation_type",
       "oauth_application",
-      "actor",
       "created_at",
       "marketplace_listing",
-      "request_id",
-      "actor_id",
-      "primary_category",
-      "user"
+      "primary_category"
     ]
   },
   {
@@ -2853,22 +4287,35 @@
     "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "primary_category",
       "secondary_category",
       "marketplace_listing",
       "oauth_application",
       "oauth_application_id",
-      "user",
-      "user_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -2876,19 +4323,31 @@
     "description": "A pull request was removed from a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -2896,21 +4355,30 @@
     "description": "A pull request was moved ahead in a merge queue.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
       "token_id",
       "token_scopes",
-      "repo_id",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2920,16 +4388,29 @@
     "description": "A merge queue was cleared.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2939,18 +4420,31 @@
     "description": "The settings for a merge queue were updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "max_entries_to_build",
       "min_entries_to_merge",
-      "repo_id",
       "public_repo",
-      "repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -2960,14 +4454,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
       "@timestamp",
       "_document_id",
-      "user_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -2975,19 +4485,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id"
+      "created_at"
     ]
   },
   {
@@ -2995,18 +4516,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "created_at",
-      "operation_type",
       "org_id",
-      "@timestamp",
-      "_document_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3014,23 +4547,31 @@
     "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "org",
-      "repo_id",
       "action",
       "actor",
-      "created_at",
-      "operation_type",
-      "@timestamp",
-      "user_agent",
-      "request_id",
       "actor_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
     ]
   },
   {
@@ -3038,20 +4579,30 @@
     "description": "An OAuth access token was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
     "fields": [
-      "_document_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "user",
-      "user_id",
-      "created_at",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "request_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
@@ -3062,19 +4613,30 @@
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
     "fields": [
       "@timestamp",
-      "user_agent",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
       "explanation",
-      "hashed_token",
-      "actor_id",
-      "token_scopes",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
@@ -3084,37 +4646,60 @@
     "description": "An OAuth access token was regenerated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "_document_id",
-      "created_at",
       "@timestamp",
-      "operation_type",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "oauth_application_name"
-    ]
-  },
-  {
-    "action": "oauth_access.revoke",
-    "description": "An OAuth access token was revoked.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "request_id",
-      "request_access_security_header",
+      "business",
+      "business_id",
       "hashed_token",
-      "token_id",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_name"
+    ]
+  },
+  {
+    "action": "oauth_access.revoke",
+    "description": "An OAuth access token was revoked.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -3124,18 +4709,30 @@
     "description": "An OAuth access token was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
-      "created_at",
       "action",
-      "@timestamp",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3143,20 +4740,32 @@
     "description": "An OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
       "operation_type",
-      "user_agent",
-      "actor_id",
-      "org_id",
-      "action",
-      "actor",
-      "oauth_application",
-      "@timestamp",
-      "_document_id",
-      "request_id",
-      "request_access_security_header"
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3165,20 +4774,32 @@
     "description": "An OAuth application was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "created_at",
-      "oauth_application_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "user_agent",
-      "oauth_application",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "oauth_application_id",
+      "operation_type",
+      "oauth_application"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3187,20 +4808,32 @@
     "description": "An OAuth application's secret key was generated.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3209,20 +4842,32 @@
     "description": "An OAuth application's secret key was deleted.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3231,19 +4876,32 @@
     "description": "The secret key for an OAuth application was reset.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "oauth_application",
       "operation_type",
-      "request_id",
-      "actor_id",
-      "_document_id",
       "created_at",
-      "actor",
-      "oauth_application_id",
-      "@timestamp",
-      "user_agent"
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3252,20 +4910,32 @@
     "description": "All user tokens for an OAuth application were requested to be revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "oauth_application",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3274,41 +4944,66 @@
     "description": "Token(s) for an OAuth application were revoked.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "oauth_application_id",
-      "oauth_application",
-      "actor_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "action",
       "_document_id",
+      "action",
       "actor",
-      "user",
-      "created_at",
-      "operation_type",
-      "request_access_security_header"
-    ],
-    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
-  },
-  {
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "oauth_application",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
+  },
+  {
     "action": "oauth_application.transfer",
     "description": "An OAuth application was transferred from one account to another.",
     "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "oauth_application",
-      "actor_id",
-      "oauth_application_id",
       "@timestamp",
-      "user_id",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "oauth_application",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
   },
@@ -3317,24 +5012,31 @@
     "description": "An authorization for an OAuth application was created.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
-      "operation_type",
-      "user_agent",
-      "user_id",
-      "actor",
-      "org_id",
+      "@timestamp",
       "_document_id",
-      "request_id",
       "action",
-      "@timestamp",
-      "created_at",
+      "actor",
       "actor_id",
-      "user",
       "business",
       "business_id",
-      "token_scopes",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "actor_is_bot",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "actor_is_bot",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -3344,20 +5046,31 @@
     "description": "An authorization for an OAuth application was deleted.",
     "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
     "fields": [
-      "user_agent",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "actor",
       "created_at",
       "explanation",
-      "user",
-      "user_id",
-      "org_id",
-      "action",
-      "actor_id",
-      "token_scopes",
       "actor_is_bot",
       "oauth_application_name"
     ],
@@ -3368,20 +5081,31 @@
     "description": "An authorization for an OAuth application was updated.",
     "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
-      "actor_id",
       "user_agent",
-      "@timestamp",
       "operation_type",
-      "action",
-      "user",
       "created_at",
-      "_document_id",
       "actor_is_bot",
-      "request_access_security_header",
       "oauth_application_name"
     ],
     "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
@@ -3391,21 +5115,31 @@
     "description": "A user joined an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "permission",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "operation_type",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
-      "user_agent",
-      "org_id",
       "user_id",
-      "actor_id",
-      "action",
-      "programmatic_access_type",
+      "user_agent",
+      "permission",
+      "operation_type",
+      "created_at",
       "actor_is_bot"
     ]
   },
@@ -3414,24 +5148,34 @@
     "description": "An outside collaborator was added to a repository.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "inviter",
       "public_repo",
       "permission",
       "invitee",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3439,20 +5183,30 @@
     "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "business",
-      "business_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3460,22 +5214,30 @@
     "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3483,20 +5245,30 @@
     "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "business",
       "business_id",
-      "token_scopes"
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -3504,22 +5276,30 @@
     "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "token_scopes"
+      "created_at"
     ]
   },
   {
@@ -3527,21 +5307,30 @@
     "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
-      "request_id",
-      "actor_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "@timestamp",
-      "created_at",
-      "user",
-      "operation_type",
-      "org_id",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -3549,26 +5338,35 @@
     "description": "A CSV export was requested on the CodeQL pull request alerts page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "actor_is_bot"
     ]
   },
@@ -3577,26 +5375,34 @@
     "description": "A CSV export was requested on the Coverage page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3604,28 +5410,36 @@
     "description": "A CSV export was requested on the Overview Dashboard page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
       "start_date",
       "end_date",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3633,26 +5447,34 @@
     "description": "A CSV export was requested on the Risk page.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "query",
       "filename",
       "requested_at",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -3660,18 +5482,28 @@
     "description": "The cache retention policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3683,18 +5515,28 @@
     "description": "The cache storage policy for GitHub Actions was set for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "org",
-      "org_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -3706,20 +5548,31 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
   },
@@ -3728,16 +5581,29 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "created_at",
       "operation_type"
     ],
@@ -3748,18 +5614,31 @@
     "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
   },
@@ -3768,18 +5647,30 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
   },
@@ -3788,18 +5679,31 @@
     "description": "The policy for workflows on private repository forks was changed.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
   },
@@ -3808,18 +5712,30 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
     "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -3829,20 +5745,31 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "org_id",
-      "created_at",
       "_document_id",
-      "user",
-      "user_id",
       "action",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "old_permission",
       "permission",
-      "actor",
-      "user_agent",
-      "operation_type",
-      "org"
+      "operation_type"
     ]
   },
   {
@@ -3850,17 +5777,30 @@
     "description": "The create repository permission for organization members was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "action",
       "@timestamp",
-      "request_id",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "permission",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
       "visibility",
       "operation_type"
     ]
@@ -3870,20 +5810,31 @@
     "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
     "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
     "fields": [
-      "actor_id",
-      "permission",
+      "@timestamp",
+      "_document_id",
       "action",
-      "org_id",
       "actor",
-      "created_at",
-      "_document_id",
+      "actor_id",
+      "business",
       "business_id",
-      "operation_type",
+      "hashed_token",
       "org",
-      "user_agent",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "business",
-      "@timestamp"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "permission",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "Setting permissions for adding outside collaborators"
   },
@@ -3892,20 +5843,34 @@
     "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -3914,41 +5879,70 @@
     "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "owner",
-      "owner_type",
-      "domain",
-      "state",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
-      "operation_type"
-    ],
-    "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "owner",
+      "owner_type",
+      "domain",
+      "state",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
   {
     "action": "pages_protected_domain.verify",
     "description": "A GitHub Pages domain was verified for an organization or enterprise.",
     "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "owner",
       "owner_type",
       "domain",
       "state",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
   },
@@ -3957,19 +5951,31 @@
     "description": "A new passkey was added.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3977,19 +5983,31 @@
     "description": "A new passkey was removed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "nickname",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "nickname",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -3997,18 +6015,30 @@
     "description": "A new payment method was added, such as a new credit card or PayPal account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
-      "user_id",
+      "@timestamp",
       "_document_id",
       "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4016,16 +6046,30 @@
     "description": "A payment method was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "actor_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "operation_type",
       "actor",
-      "_document_id",
-      "request_access_security_header"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -4033,18 +6077,30 @@
     "description": "An existing payment method was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "request_id",
-      "org_id",
-      "created_at",
-      "actor_id",
       "@timestamp",
+      "_document_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4052,18 +6108,31 @@
     "description": "A fine-grained personal access token was granted access to resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4074,18 +6143,31 @@
     "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "user_programmatic_access_id",
       "user_programmatic_access_name",
       "repository_selection",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4096,17 +6178,30 @@
     "description": "Triggered when you create a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
+      "repository_selection",
       "created_at",
       "operation_type"
     ]
@@ -4116,19 +6211,31 @@
     "description": "Triggered when you regenerate a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4136,12 +6243,29 @@
     "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
     "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
     "fields": [
-      "user_programmatic_access_name",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "user_programmatic_access_name",
       "created_at",
       "operation_type"
     ],
@@ -4152,20 +6276,32 @@
     "description": "Triggered when you delete a fine-grained personal access token.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "explanation",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4173,17 +6309,30 @@
     "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -4194,18 +6343,31 @@
     "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_id",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -4217,17 +6379,30 @@
     "description": "A request for a fine-grained personal access token to access organization resources was denied.",
     "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "user_programmatic_access_request_id"
@@ -4239,17 +6414,30 @@
     "description": "A fine-grained personal access token was updated.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_programmatic_access_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "user_programmatic_access_name",
       "repository_selection",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4260,15 +6448,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "runner_group_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -4278,17 +6481,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "user_id",
       "business",
       "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4298,35 +6512,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
-      "name",
-      "runner_group_id",
-      "action",
-      "_document_id",
       "@timestamp",
-      "created_at",
-      "operation_type"
-    ]
-  },
-  {
-    "action": "private_vulnerability_reporting.disable",
-    "description": "N/A",
-    "docs_reference_links": "N/A",
-    "fields": [
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "name",
+      "runner_group_id",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "private_vulnerability_reporting.disable",
+    "description": "N/A",
+    "docs_reference_links": "N/A",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4336,17 +6576,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4356,17 +6607,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4376,17 +6638,28 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -4396,17 +6669,30 @@
     "description": "A profile picture was updated.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
     "fields": [
-      "user",
-      "actor_id",
-      "user_id",
       "@timestamp",
-      "created_at",
-      "owner",
-      "action",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
+      "created_at",
+      "owner",
       "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
@@ -4416,17 +6702,30 @@
     "description": "A project board visibility was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "user_agent",
-      "operation_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "created_at",
       "user_id",
-      "action",
-      "request_id",
-      "_document_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4434,20 +6733,31 @@
     "description": "A project board was closed.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
     "fields": [
-      "org_id",
-      "user_agent",
-      "request_id",
-      "operation_type",
       "@timestamp",
-      "created_at",
-      "repo_id",
-      "org",
       "_document_id",
-      "project_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "project_id",
       "project_kind"
     ],
     "docs_reference_titles": "Closing a project (classic)"
@@ -4457,25 +6767,37 @@
     "description": "A collaborator was added to a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "collaborator_type",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot",
       "public_project",
       "project_name",
       "project_role",
-      "old_project_role",
-      "request_access_security_header"
+      "old_project_role"
     ]
   },
   {
@@ -4483,20 +6805,32 @@
     "description": "A collaborator was removed from a project.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "collaborator_type",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
+      "collaborator_type",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4504,25 +6838,37 @@
     "description": "A project collaborator's permission level was changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_project",
       "project_name",
       "collaborator_type",
       "project_role",
       "old_project_role",
       "project_id",
-      "user",
-      "user_id",
       "collaborator",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -4530,17 +6876,30 @@
     "description": "A project board was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "@timestamp",
-      "actor_id",
-      "action",
-      "created_at",
-      "actor"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4548,17 +6907,30 @@
     "description": "A project board was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "actor_id",
-      "operation_type",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "user_agent",
-      "user"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4566,18 +6938,30 @@
     "description": "A field was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
   },
@@ -4586,18 +6970,30 @@
     "description": "A field was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
   },
@@ -4606,19 +7002,30 @@
     "description": "A repository was linked to a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
       "org_id",
-      "user_agent",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "created_at",
-      "org",
-      "repo"
+      "created_at"
     ]
   },
   {
@@ -4626,17 +7033,30 @@
     "description": "A project board was reopened.",
     "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "project_id",
-      "_document_id",
       "user_agent",
+      "project_id",
       "operation_type",
-      "user",
-      "@timestamp",
       "created_at",
       "project_kind",
       "project_name"
@@ -4648,22 +7068,31 @@
     "description": "A project board was renamed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "action",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "old_name",
-      "operation_type",
       "@timestamp",
-      "repo",
       "_document_id",
-      "user_agent",
-      "org_id",
-      "business_id",
+      "action",
       "actor",
-      "repo_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "business"
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "old_name",
+      "operation_type"
     ]
   },
   {
@@ -4671,19 +7100,30 @@
     "description": "A repository was unlinked from a project board.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "repo_id",
-      "operation_type",
-      "actor",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "org",
-      "org_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4691,36 +7131,62 @@
     "description": "The project's base-level permission for all organization members was changed or removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "org",
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "created_at",
-      "request_id",
-      "actor_id",
       "action",
-      "org_id",
-      "user_agent"
-    ]
-  },
-  {
-    "action": "project.update_team_permission",
-    "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "created_at",
-      "org_id",
-      "operation_type",
-      "org",
+      "actor",
       "actor_id",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "team",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "project.update_team_permission",
+    "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "created_at",
+      "operation_type",
+      "team"
     ]
   },
   {
@@ -4728,20 +7194,30 @@
     "description": "A user was added to or removed from a project board or had their permission level changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "actor_id",
-      "user",
-      "user_agent",
+      "_document_id",
+      "action",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
-      "_document_id",
       "org_id",
-      "action",
-      "programmatic_access_type"
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -4749,18 +7225,30 @@
     "description": "A view was created in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -4769,18 +7257,30 @@
     "description": "A view was deleted in a project board.",
     "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
   },
@@ -4789,16 +7289,29 @@
     "description": "A project's visibility was changed from public to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
@@ -4810,21 +7323,33 @@
     "description": "A project's visibility was changed from private to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "project_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "project_id",
       "created_at",
       "operation_type",
       "project_kind",
-      "project_name",
-      "request_access_security_header"
+      "project_name"
     ]
   },
   {
@@ -4832,18 +7357,31 @@
     "description": "Enforcement of the merge queue was modified for a branch.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "name",
       "merge_queue_enforcement_level",
-      "repo",
-      "repo_id",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -4854,23 +7392,34 @@
     "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
     "fields": [
-      "read_only",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "read_only",
       "operation_type",
       "created_at",
-      "_document_id",
       "key",
       "fingerprint",
-      "actor",
-      "action",
-      "user",
-      "user_id",
-      "@timestamp",
-      "request_id",
-      "title",
-      "token_scopes",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
   },
@@ -4879,24 +7428,35 @@
     "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
     "fields": [
-      "fingerprint",
-      "user_agent",
-      "read_only",
-      "explanation",
-      "repo",
       "@timestamp",
-      "action",
-      "key",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
-      "title",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "created_at",
-      "token_scopes",
-      "programmatic_access_type"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "fingerprint",
+      "read_only",
+      "explanation",
+      "key",
+      "operation_type",
+      "title",
+      "created_at"
     ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
   },
@@ -4905,20 +7465,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "title",
       "key",
       "fingerprint",
       "read_only",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "token_scopes"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4927,21 +7501,34 @@
     "description": "A user account's SSH key or a repository's deploy key was unverified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "created_at",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "title",
-      "request_id",
-      "key",
       "action",
       "actor",
-      "read_only",
-      "explanation",
-      "repo_id",
-      "@timestamp",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "created_at",
+      "operation_type",
+      "title",
+      "key",
+      "read_only",
+      "explanation",
       "fingerprint"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
@@ -4951,22 +7538,34 @@
     "description": "A user account's SSH key or a repository's deploy key was updated.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "key",
       "fingerprint",
       "read_only",
-      "repo_id",
       "operation_type",
       "created_at",
-      "actor_id",
-      "repo",
-      "action",
-      "_document_id",
-      "request_id",
-      "title",
-      "@timestamp",
-      "programmatic_access_type"
+      "title"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -4975,25 +7574,35 @@
     "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "repo_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "fingerprint",
-      "@timestamp",
-      "request_id",
-      "actor_id",
       "oauth_application_id",
       "title",
-      "action",
-      "user_agent",
       "created_at",
-      "repo",
       "read_only",
-      "operation_type",
-      "_document_id",
-      "user",
-      "user_id",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -5002,23 +7611,34 @@
     "description": "A user account's SSH key or a repository's deploy key was verified.",
     "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
     "fields": [
-      "operation_type",
-      "user",
       "@timestamp",
       "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
       "key",
       "fingerprint",
-      "actor_id",
-      "actor",
       "title",
-      "user_agent",
-      "user_id",
-      "request_id",
-      "read_only",
-      "token_scopes",
-      "programmatic_access_type"
+      "read_only"
     ],
     "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
   },
@@ -5027,22 +7647,32 @@
     "description": "The visibility of a repository changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
     "fields": [
-      "repo_id",
-      "user",
-      "request_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "created_at",
       "user_agent",
-      "actor",
-      "action",
-      "repo",
+      "operation_type",
+      "created_at",
       "visibility",
-      "_document_id",
-      "previous_visibility",
-      "programmatic_access_type"
+      "previous_visibility"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
   },
@@ -5051,21 +7681,30 @@
     "description": "GitHub Actions was enabled for a repository.",
     "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "created_at",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
   },
@@ -5074,25 +7713,32 @@
     "description": "A collaborator was added to a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
     "fields": [
-      "visibility",
-      "repo",
-      "created_at",
-      "user_agent",
-      "operation_type",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "repo_id",
-      "user",
-      "request_id",
-      "action",
-      "user_id",
-      "oauth_application_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ],
     "docs_reference_titles": "Inviting collaborators to a personal repository"
   },
@@ -5101,23 +7747,31 @@
     "description": "A topic was added to a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
       "actor",
-      "repo",
-      "repo_id",
-      "user",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "topic",
-      "@timestamp",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "topic",
       "created_at",
-      "operation_type",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
   },
@@ -5126,24 +7780,31 @@
     "description": "GitHub Advanced Security was disabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
   },
@@ -5152,23 +7813,31 @@
     "description": "GitHub Advanced Security was enabled for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "business",
-      "business_id",
-      "action",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
@@ -5178,22 +7847,31 @@
     "description": "A repository was archived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
-      "repo_id",
-      "user_agent",
-      "user_id",
-      "created_at",
       "@timestamp",
-      "repo",
-      "user",
-      "operation_type",
-      "visibility",
+      "_document_id",
       "action",
-      "actor_id",
       "actor",
-      "_document_id",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -5202,19 +7880,32 @@
     "description": "Pull request merge options were changed for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "user_agent",
-      "request_id",
-      "created_at",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type",
-      "action",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -5223,24 +7914,34 @@
     "description": "Code scanning analysis for a repository was deleted.",
     "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
       "tool",
-      "category",
-      "request_access_security_header"
+      "category"
     ],
     "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
   },
@@ -5249,23 +7950,32 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "tool",
       "branch",
       "category",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -5276,17 +7986,30 @@
     "description": "The interaction limit for collaborators only was disabled.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "repo",
-      "operation_type",
-      "@timestamp",
-      "request_id"
+      "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -5295,15 +8018,28 @@
     "description": "The interaction limit for prior contributors only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "repo",
       "@timestamp",
-      "request_id",
-      "actor",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -5314,36 +8050,62 @@
     "description": "The interaction limit for existing users only was disabled in a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "request_id",
-      "repo_id",
-      "action",
-      "user_agent",
-      "_document_id",
       "@timestamp",
-      "created_at",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type"
-    ],
-    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
   {
     "action": "repo.config.enable_collaborators_only",
     "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "oauth_application_id",
-      "created_at",
-      "action",
-      "request_id",
-      "repo_id",
-      "repo",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
@@ -5353,19 +8115,30 @@
     "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "operation_type",
-      "created_at",
-      "actor",
-      "org",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "org_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -5374,17 +8147,30 @@
     "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
     "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
     "fields": [
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "@timestamp",
-      "_document_id"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
   },
@@ -5393,26 +8179,32 @@
     "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
     "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "token_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
   },
@@ -5421,30 +8213,35 @@
     "description": "A repository was created.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "user_id",
-      "visibility",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "action",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
       "request_category",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "actor",
-      "user_agent",
-      "org",
       "oauth_application_id",
-      "org_id",
       "request_method",
-      "business",
-      "business_id",
       "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
@@ -5454,20 +8251,31 @@
     "description": "A GitHub Actions secret was created for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5476,25 +8284,33 @@
     "description": "A GitHub Actions variable was created for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5503,23 +8319,34 @@
     "description": "A Codespaces or Dependabot secret was created for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5527,25 +8354,34 @@
     "description": "A repository was deleted.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "user_agent",
-      "user_id",
-      "actor",
       "action",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "request_category",
-      "actor_id",
       "visibility",
-      "request_id",
       "created_at",
-      "@timestamp",
       "request_method",
       "oauth_application_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
@@ -5555,23 +8391,33 @@
     "description": "A GitHub Pages custom domain was modified in a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
       "@timestamp",
-      "visibility",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "user",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor_id",
-      "cname",
-      "user_agent",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "visibility",
+      "cname",
       "created_at",
-      "_document_id",
-      "action",
       "operation_type",
-      "old_cname",
-      "programmatic_access_type"
+      "old_cname"
     ]
   },
   {
@@ -5579,21 +8425,31 @@
     "description": "A GitHub Pages site was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
       "user_id",
-      "visibility",
-      "action",
       "user_agent",
+      "visibility",
       "operation_type",
-      "repo_id",
-      "created_at",
-      "@timestamp",
-      "request_id",
-      "actor",
-      "repo",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5601,21 +8457,31 @@
     "description": "A GitHub Pages site was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "repo",
+      "user_id",
       "user_agent",
-      "_document_id",
-      "actor_id",
-      "@timestamp",
-      "actor",
+      "created_at",
       "visibility",
-      "operation_type",
-      "repo_id",
-      "programmatic_access_type"
+      "operation_type"
     ]
   },
   {
@@ -5623,22 +8489,31 @@
     "description": "HTTPS redirects were disabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "_document_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
       "visibility",
-      "user_id",
-      "request_id",
-      "repo",
-      "@timestamp",
       "operation_type",
-      "action",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -5646,21 +8521,31 @@
     "description": "HTTPS redirects were enabled for a GitHub Pages site.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "user_id",
-      "created_at",
-      "visibility",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user",
-      "operation_type",
-      "repo_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "_document_id",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "visibility",
+      "operation_type"
     ]
   },
   {
@@ -5668,20 +8553,31 @@
     "description": "A GitHub Pages site visibility was changed to private.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -5689,64 +8585,97 @@
     "description": "A GitHub Pages site visibility was changed to public.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "programmatic_access_type",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "repo.pages_soft_delete",
-    "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
-    "docs_reference_links": "N/A",
-    "fields": [
-      "visibility",
       "repo",
       "repo_id",
-      "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
-      "created_at",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
-    "action": "repo.pages_soft_delete_restore",
-    "description": "A GitHub Pages site that was previously soft-deleted was restored.",
+    "action": "repo.pages_soft_delete",
+    "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
-      "repo",
-      "repo_id",
-      "public_repo",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "public_repo",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "repo.pages_soft_delete_restore",
+    "description": "A GitHub Pages site that was previously soft-deleted was restored.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -5754,21 +8683,31 @@
     "description": "A GitHub Pages source was modified.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor_id",
-      "operation_type",
-      "user_agent",
-      "actor",
       "@timestamp",
-      "repo_id",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "visibility",
-      "repo",
-      "created_at",
-      "action",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5776,18 +8715,30 @@
     "description": "A new self-hosted runner was registered.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
     "fields": [
-      "actor_id",
-      "repo",
-      "operation_type",
-      "action",
       "@timestamp",
-      "actor",
-      "user_agent",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "request_access_security_header"
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Adding self-hosted runners"
   },
@@ -5796,22 +8747,31 @@
     "description": "A GitHub Actions secret was deleted for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -5820,24 +8780,32 @@
     "description": "A GitHub Actions variable was deleted for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "key",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -5846,23 +8814,33 @@
     "description": "A Codespaces or Dependabot secret was deleted for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "key",
-      "integration",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "key",
+      "integration",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -5870,26 +8848,31 @@
     "description": "A collaborator was removed from a repository.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
     "fields": [
-      "request_id",
-      "user",
-      "business",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "actor",
-      "created_at",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "user_agent",
-      "business_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "created_at",
       "operation_type",
-      "@timestamp",
-      "_document_id",
-      "visibility",
-      "repo",
-      "token_scopes",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "Removing a collaborator from a personal repository"
   },
@@ -5898,22 +8881,31 @@
     "description": "A self-hosted runner was removed.",
     "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
     "fields": [
-      "request_id",
-      "actor_id",
-      "repo_id",
       "@timestamp",
       "_document_id",
-      "repo",
-      "org_id",
       "action",
-      "operation_type",
-      "user_agent",
       "actor",
-      "created_at",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
-    ],
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ],
     "docs_reference_titles": "Removing self-hosted runners"
   },
   {
@@ -5921,25 +8913,31 @@
     "description": "A topic was removed from a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "topic",
       "operation_type",
-      "user_id",
-      "org",
-      "org_id",
-      "actor",
-      "business",
-      "request_id",
-      "repo",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "actor_id",
-      "business_id",
-      "programmatic_access_type"
+      "created_at"
     ]
   },
   {
@@ -5947,22 +8945,32 @@
     "description": "A repository was renamed.",
     "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
     "fields": [
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
+      "action",
       "actor",
-      "old_name",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
+      "old_name",
       "created_at",
-      "user",
-      "action",
       "operation_type",
-      "visibility",
-      "repo_id",
-      "_document_id",
-      "programmatic_access_type"
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
   },
@@ -5971,19 +8979,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "request_id",
-      "repo_id",
-      "@timestamp",
-      "created_at",
-      "actor",
-      "user_id"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -5991,22 +9010,30 @@
     "description": "The cache retention policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -6018,22 +9045,30 @@
     "description": "The cache storage policy for GitHub Actions was set for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "public_repo",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "actor_is_bot"
@@ -6045,23 +9080,32 @@
     "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "policy",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "public_repo"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
@@ -6071,20 +9115,31 @@
     "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ],
@@ -6095,21 +9150,32 @@
     "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "limit",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "limit",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
   },
@@ -6118,22 +9184,32 @@
     "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
   },
@@ -6142,21 +9218,32 @@
     "description": "Triggered when the policy for workflows on private repository forks is changed.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "policy",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
+      "policy",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
   },
@@ -6165,22 +9252,32 @@
     "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "public_repo",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "visibility",
+      "public_repo",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
   },
@@ -6191,16 +9288,27 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_agent",
-      "actor_id",
-      "created_at",
-      "actor",
-      "repo_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "request_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -6209,22 +9317,31 @@
     "description": "Temporary access was enabled for a repository.",
     "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "repo",
-      "repo_id",
+      "user_agent",
       "public_repo",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ],
     "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
   },
@@ -6234,22 +9351,33 @@
     "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
     "fields": [
       "@timestamp",
-      "user_id",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
-      "owner",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "owner",
       "old_user",
-      "action",
       "operation_type",
       "created_at",
-      "user_agent",
-      "repo",
       "visibility",
-      "repo_was",
-      "actor"
+      "repo_was"
     ],
     "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
   },
@@ -6258,23 +9386,33 @@
     "description": "A repository was transferred to another repository network.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "new_nwo",
       "visibility",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "public_repo",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -6284,19 +9422,29 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "operation_type",
-      "user_id",
-      "request_id",
-      "user",
       "action",
-      "user_agent",
-      "created_at",
       "actor",
-      "visibility",
-      "repo_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "request_access_security_header"
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ]
   },
   {
@@ -6304,21 +9452,31 @@
     "description": "A repository was unarchived.",
     "docs_reference_links": "/repositories/archiving-a-github-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
-      "request_id",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "operation_type",
-      "created_at",
-      "_document_id",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "visibility",
-      "user_agent",
       "user_id",
-      "action",
-      "programmatic_access_type"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "visibility"
     ],
     "docs_reference_titles": "/repositories/archiving-a-github-repository"
   },
@@ -6327,24 +9485,33 @@
     "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "visibility",
       "policy",
       "old_policy",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id"
+      "operation_type"
     ]
   },
   {
@@ -6352,25 +9519,32 @@
     "description": "A GitHub Actions secret was updated for a repository.",
     "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "oauth_application_id",
-      "key",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
       "business",
       "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "key",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Using secrets in GitHub Actions"
   },
@@ -6379,24 +9553,34 @@
     "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
-      "repo",
-      "repo_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
-      "action",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "new_policy",
       "old_policy",
       "updated_access_policy",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6405,25 +9589,33 @@
     "description": "A GitHub Actions variable was updated for a repository.",
     "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "business",
-      "business_id",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Store information in variables"
   },
@@ -6432,22 +9624,31 @@
     "description": "The default branch for a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "visibility",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
+      "visibility",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6456,26 +9657,34 @@
     "description": "A Codespaces or Dependabot secret was updated for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "repo",
-      "repo_id",
-      "org",
-      "org_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -6483,31 +9692,38 @@
     "description": "A user's permission to a repository was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "oauth_application_id",
-      "user",
-      "@timestamp",
-      "repo",
       "operation_type",
-      "request_id",
-      "org_id",
-      "actor_id",
       "visibility",
       "old_permission",
-      "org",
-      "user_id",
       "old_base_role",
       "old_repo_permission",
       "old_repo_base_role",
       "new_repo_base_role",
       "new_repo_permission",
-      "token_scopes",
-      "programmatic_access_type",
       "actor_is_bot"
     ]
   },
@@ -6516,21 +9732,31 @@
     "description": "An image to represent a repository was uploaded.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "operation_type",
-      "created_at",
-      "actor_id",
-      "repo_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
       "actor",
-      "content_type",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
-      "_document_id",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at",
+      "content_type"
     ]
   },
   {
@@ -6538,21 +9764,31 @@
     "description": "An image to represent a repository was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
-      "content_type",
-      "created_at",
-      "actor_id",
-      "user_id",
-      "operation_type",
-      "request_id",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
-      "repo_id",
-      "user_agent",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "content_type",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6560,21 +9796,32 @@
     "description": "An invitation to join a repository was accepted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "created_at",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "invitee",
-      "operation_type",
-      "actor",
       "repo_id",
-      "_document_id",
-      "action",
-      "user_agent",
-      "inviter",
-      "@timestamp",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "invitee",
+      "operation_type",
+      "inviter"
     ]
   },
   {
@@ -6582,20 +9829,32 @@
     "description": "An invitation to join a repository was canceled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "inviter",
-      "action",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "repo_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "@timestamp",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "inviter",
+      "operation_type",
       "invitee",
-      "created_at",
-      "request_id",
-      "actor",
-      "actor_id",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -6603,21 +9862,32 @@
     "description": "An invitation to join a repository was sent.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
-      "invitee",
-      "action",
-      "request_id",
-      "inviter",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
-      "created_at",
-      "user_agent",
       "repo_id",
-      "operation_type",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
+      "inviter",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6625,19 +9895,32 @@
     "description": "An invitation to join a repository was declined.",
     "docs_reference_links": "N/A",
     "fields": [
-      "repo",
+      "@timestamp",
       "_document_id",
-      "actor",
-      "invitee",
       "action",
-      "@timestamp",
-      "request_id",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "invitee",
       "operation_type",
       "created_at",
-      "inviter",
-      "user_agent",
-      "repo_id"
+      "inviter"
     ]
   },
   {
@@ -6645,31 +9928,39 @@
     "description": "A repository ruleset was created.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
       "ruleset_conditions",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
   },
@@ -6678,19 +9969,30 @@
     "description": "A repository ruleset was deleted.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
       "ruleset_id",
@@ -6698,8 +10000,7 @@
       "ruleset_enforcement",
       "ruleset_source_type",
       "ruleset_rules",
-      "ruleset_bypass_actors",
-      "request_access_security_header"
+      "ruleset_bypass_actors"
     ],
     "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
   },
@@ -6708,23 +10009,32 @@
     "description": "A repository ruleset was edited.",
     "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "old_name",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_name",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
       "ruleset_id",
       "ruleset_name",
       "ruleset_enforcement",
@@ -6749,18 +10059,30 @@
     "description": "A security key was registered for an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "created_at",
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -6768,18 +10090,30 @@
     "description": "A security key was removed from an account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "operation_type",
-      "_document_id",
-      "user_agent",
       "@timestamp",
-      "request_id",
-      "actor_id",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -6787,31 +10121,59 @@
     "description": "A user linked a social identity to their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "request_access_security_header",
-      "user_id",
-      "action",
-      "actor_id",
-      "_document_id",
       "@timestamp",
-      "created_at",
-      "operation_type"
-    ]
-  },
-  {
-    "action": "social_identity.unlinked",
-    "description": "A user unlinked a social identity from their account.",
-    "docs_reference_links": "N/A",
-    "fields": [
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
-      "action",
-      "_document_id",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "social_identity.unlinked",
+    "description": "A user unlinked a social identity from their account.",
+    "docs_reference_links": "N/A",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6821,15 +10183,28 @@
     "description": "A user unlinked all social identities from their account.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
       "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type"
     ]
@@ -6839,16 +10214,29 @@
     "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6858,18 +10246,31 @@
     "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
   },
@@ -6878,16 +10279,29 @@
     "description": "The fiscal host for a GitHub Sponsors listing was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
       "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -6898,15 +10312,28 @@
     "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
     "fields": [
       "@timestamp",
-      "action",
-      "created_at",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
       "repository",
       "repository_id",
-      "actor",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor_id",
+      "created_at",
       "operation_type"
     ],
     "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
@@ -6916,15 +10343,30 @@
     "description": "A sponsorship was canceled.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
-      "actor",
-      "user",
       "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Downgrading a sponsorship"
   },
@@ -6933,17 +10375,30 @@
     "description": "A sponsorship was created, by sponsoring an account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -6952,17 +10407,31 @@
     "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
     "fields": [
-      "active",
-      "user",
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "active",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
   },
@@ -6971,33 +10440,61 @@
     "description": "The option to receive email updates from a sponsored account was changed.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
     "fields": [
-      "actor_id",
-      "action",
       "@timestamp",
-      "request_id",
-      "user_id",
-      "created_at",
-      "user",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
-      "operation_type"
-    ],
-    "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
+    ],
+    "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
   },
   {
     "action": "sponsors.sponsor_sponsorship_tier_change",
     "description": "A sponsorship was upgraded or downgraded.",
     "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "_document_id",
       "created_at"
     ],
     "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
@@ -7007,17 +10504,30 @@
     "description": "A GitHub Sponsors account was approved.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "request_id",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -7026,17 +10536,30 @@
     "description": "A GitHub Sponsors account was created.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_id",
-      "operation_type",
-      "request_id",
-      "actor_id",
       "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "created_at",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -7045,18 +10568,31 @@
     "description": "A GitHub Sponsors account was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7065,15 +10601,29 @@
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
     "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "actor",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
   },
@@ -7083,16 +10633,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
-      "request_id",
-      "user",
-      "action",
-      "user_agent",
-      "operation_type",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_id"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7100,15 +10663,28 @@
     "description": "An application for GitHub Sponsors was submitted for approval.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "user_agent",
-      "user",
       "@timestamp",
-      "actor_id",
-      "user_id",
-      "request_id",
       "_document_id",
-      "actor",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ],
@@ -7119,16 +10695,29 @@
     "description": "The description for a sponsorship tier was changed.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
     "fields": [
-      "operation_type",
-      "request_id",
-      "actor",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
@@ -7138,17 +10727,30 @@
     "description": "Triggered when you send an email update to your sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
     "fields": [
-      "request_id",
-      "actor",
-      "action",
-      "user_agent",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "created_at",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
   },
@@ -7157,17 +10759,30 @@
     "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "patreon_email",
-      "patreon_username",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -7178,17 +10793,30 @@
     "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
     "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "patreon_email",
-      "patreon_username",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "patreon_email",
+      "patreon_username",
       "created_at",
       "operation_type"
     ],
@@ -7199,18 +10827,29 @@
     "description": "A GitHub Sponsors tier changed access for a repository.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "repo",
-      "repo_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -7220,16 +10859,29 @@
     "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -7239,17 +10891,30 @@
     "description": "You join the waitlist to join GitHub Sponsors.",
     "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
       "user_agent",
-      "actor_id",
-      "action",
       "operation_type",
-      "created_at",
-      "user",
-      "@timestamp",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
   },
@@ -7258,16 +10923,29 @@
     "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "sponsors_listing_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -7277,23 +10955,33 @@
     "description": "A parent issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7301,23 +10989,33 @@
     "description": "A parent issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7325,23 +11023,33 @@
     "description": "A sub-issue was added to an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7349,23 +11057,33 @@
     "description": "A sub-issue was removed from an issue.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "title",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "title",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -7373,15 +11091,30 @@
     "description": "Triggered when you accept a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7390,15 +11123,30 @@
     "description": "Triggered when you cancel a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7407,15 +11155,30 @@
     "description": "Triggered when you create a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7424,15 +11187,30 @@
     "description": "Triggered when you decline a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7441,15 +11219,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7457,15 +11250,30 @@
     "description": "Triggered when you revoke a succession invitation.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "action",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
   },
@@ -7474,17 +11282,30 @@
     "description": "A new trusted device was added.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7492,17 +11313,30 @@
     "description": "A trusted device was removed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7510,14 +11344,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "action",
-      "request_id",
-      "user_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -7526,15 +11375,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "created_at",
-      "user_id",
-      "operation_type",
-      "user",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7542,13 +11406,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "_document_id",
-      "created_at",
-      "user_id",
-      "operation_type",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "action"
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7556,17 +11437,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
-      "operation_type",
-      "action",
-      "_document_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7574,17 +11468,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "actor",
-      "action",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
       "operation_type",
-      "user",
-      "created_at",
-      "request_id",
-      "actor_id",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -7592,16 +11499,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "operation_type",
       "@timestamp",
-      "user_agent",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7609,15 +11530,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "user_id",
-      "action",
       "@timestamp",
-      "created_at",
-      "user_agent",
-      "user",
       "_document_id",
-      "request_id"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7625,18 +11561,30 @@
     "description": "A secondary authentication factor was added to a user account.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -7645,18 +11593,30 @@
     "description": "Two-factor authentication was disabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
     "fields": [
-      "actor",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_id",
-      "@timestamp",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Disabling two-factor authentication for your personal account"
   },
@@ -7665,18 +11625,30 @@
     "description": "Two-factor authentication was enabled for a user account.",
     "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
     "fields": [
-      "actor",
-      "operation_type",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "created_at",
+      "actor",
       "actor_id",
-      "@timestamp",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Configuring two-factor authentication"
   },
@@ -7685,15 +11657,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user",
-      "user_id",
-      "action",
       "@timestamp",
-      "request_id",
       "_document_id",
-      "user_agent"
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7701,36 +11688,61 @@
     "description": "Two factor recovery codes were regenerated for a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "operation_type",
+      "@timestamp",
       "_document_id",
-      "user_id",
       "action",
-      "user",
-      "user_agent",
-      "actor_id",
-      "@timestamp",
-      "created_at"
-    ]
-  },
-  {
-    "action": "two_factor_authentication.remove_factor",
-    "description": "A secondary authentication factor was removed from a user account.",
-    "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
-    "fields": [
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "two_factor_authentication.remove_factor",
+    "description": "A secondary authentication factor was removed from a user account.",
+    "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
+    "fields": [
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
   },
@@ -7739,15 +11751,30 @@
     "description": "A one-time password code was sent to a user account fallback phone number.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "operation_type",
-      "user_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
-      "created_at",
-      "_document_id",
-      "action",
-      "@timestamp"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7756,16 +11783,29 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "created_at",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "operation_type",
       "user_agent",
-      "action",
-      "request_id",
-      "actor",
-      "actor_id"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7773,19 +11813,31 @@
     "description": "An email address was added to a user account.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
       "user_agent",
       "operation_type",
-      "_document_id",
-      "actor_id",
-      "actor",
       "email",
-      "@timestamp",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ],
     "docs_reference_titles": "Adding an email address to your GitHub account"
   },
@@ -7794,18 +11846,30 @@
     "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor",
-      "user_id",
-      "created_at",
-      "user",
       "@timestamp",
       "_document_id",
-      "request_id",
+      "action",
+      "actor",
       "actor_id",
-      "operation_type",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "action",
-      "request_access_security_header"
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -7813,15 +11877,28 @@
     "description": "Audit log entries were exported.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user",
-      "action",
-      "request_id",
-      "actor",
       "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "operation_type",
       "created_at"
     ]
@@ -7831,20 +11908,31 @@
     "description": "A user was blocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
-      "user_id",
-      "_document_id",
       "actor_id",
-      "@timestamp",
-      "user_agent",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "created_at",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -7852,18 +11940,30 @@
     "description": "A user changed their password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
       "@timestamp",
-      "user_agent",
-      "actor_id",
-      "operation_type",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "created_at",
-      "_document_id",
-      "request_access_security_header"
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7871,18 +11971,30 @@
     "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id",
-      "programmatic_access_type"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -7891,17 +12003,30 @@
     "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
     "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
     "fields": [
-      "user_agent",
-      "request_id",
-      "actor",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ],
     "docs_reference_titles": "Managing access to other repositories within your codespace"
   },
@@ -7910,19 +12035,31 @@
     "description": "A new user account was created.",
     "docs_reference_links": "N/A",
     "fields": [
-      "email",
-      "user_id",
-      "operation_type",
       "@timestamp",
-      "request_id",
-      "user",
-      "created_at",
       "_document_id",
-      "user_agent",
+      "action",
       "actor",
       "actor_id",
-      "action",
-      "programmatic_access_type"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "email",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7930,21 +12067,33 @@
     "description": "A user secret for Codespaces was created.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -7952,20 +12101,31 @@
     "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "created_at",
-      "user_agent",
+      "@timestamp",
       "_document_id",
-      "operation_type",
-      "oauth_application_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "user_id",
-      "@timestamp",
+      "token_id",
       "token_scopes",
-      "programmatic_access_type"
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "oauth_application_id"
     ]
   },
   {
@@ -7973,18 +12133,30 @@
     "description": "A user account was destroyed by an asynchronous job.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
       "action",
-      "request_id",
-      "user_id",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -7993,19 +12165,30 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "oauth_application_id",
+      "_document_id",
       "action",
-      "user",
-      "created_at",
-      "user_agent",
-      "request_id",
       "actor",
       "actor_id",
-      "operation_type",
-      "_document_id",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8013,18 +12196,30 @@
     "description": "A user deleted his or her account, triggering user.async_delete.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "_document_id",
-      "created_at",
-      "user_agent",
       "user_id",
-      "operation_type",
-      "actor_id",
-      "action",
-      "@timestamp",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8032,18 +12227,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "user_agent",
       "user_id",
-      "actor_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8051,18 +12258,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "_document_id",
-      "@timestamp",
-      "user",
-      "actor_id",
-      "action",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8071,35 +12290,60 @@
     "docs_reference_links": "N/A",
     "fields": [
       "@timestamp",
-      "user",
       "_document_id",
       "action",
-      "operation_type",
-      "user_agent",
-      "created_at",
-      "request_id",
       "actor",
       "actor_id",
-      "user_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "user.disable_collaborators_only",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
+  {
+    "action": "user.disable_collaborators_only",
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8107,17 +12351,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8125,17 +12382,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8143,21 +12413,31 @@
     "description": "An enterprise managed user claimed an email address.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -8165,21 +12445,31 @@
     "description": "N/A",
     "docs_reference_links": "An enterprise managed user unclaimed an email address.",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
       "operation_type",
-      "business",
-      "business_id",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ],
     "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
   },
@@ -8188,17 +12478,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8206,17 +12509,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8224,17 +12540,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
+      "user_agent",
       "operation_type",
-      "@timestamp",
-      "created_at",
-      "_document_id"
+      "created_at"
     ]
   },
   {
@@ -8242,18 +12571,30 @@
     "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "action",
-      "operation_type",
-      "request_id",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user",
-      "org_id",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8261,18 +12602,32 @@
     "description": "A user requested a password reset.",
     "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
     "fields": [
-      "action",
-      "_document_id",
-      "user_agent",
-      "request_id",
-      "user",
-      "operation_type",
       "@timestamp",
-      "email",
-      "created_at",
-      "user_id",
-      "request_access_security_header"
-    ],
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "email",
+      "created_at"
+    ],
     "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
   },
   {
@@ -8280,17 +12635,30 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "action",
-      "created_at",
-      "user_agent",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "actor",
-      "operation_type",
-      "request_id"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8298,18 +12666,30 @@
     "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -8318,19 +12698,31 @@
     "description": "A user signed in.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user_id",
-      "actor_id",
       "@timestamp",
-      "user",
-      "action",
-      "operation_type",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
       "created_at",
-      "actor",
-      "passkey_nickname",
-      "request_access_security_header"
+      "passkey_nickname"
     ]
   },
   {
@@ -8338,18 +12730,30 @@
     "description": "A user signed out.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8357,18 +12761,30 @@
     "description": "A user signed in from a new device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "user_id",
-      "actor",
-      "operation_type",
-      "created_at",
-      "user_agent",
-      "actor_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8376,21 +12792,31 @@
     "description": "An ordinary user account was promoted to a site administrator.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "@timestamp",
-      "created_at",
+      "user_id",
       "user_agent",
+      "created_at",
       "oauth_application_id",
-      "request_id",
-      "operation_type",
-      "_document_id",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8398,16 +12824,29 @@
     "description": "A user's account was restored.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "user",
-      "action",
-      "actor_id",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "actor",
       "operation_type"
     ]
   },
@@ -8416,20 +12855,31 @@
     "description": "An email address was removed from a user account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "actor",
-      "actor_id",
       "created_at",
-      "email",
-      "token_scopes",
-      "programmatic_access_type"
+      "email"
     ]
   },
   {
@@ -8437,20 +12887,32 @@
     "description": "A user secret for Codespaces was deleted.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "key",
-      "integration",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
+      "user_agent",
+      "key",
+      "integration",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8458,20 +12920,31 @@
     "description": "A username was changed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "request_id",
-      "actor_id",
-      "old_login",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "@timestamp",
-      "operation_type",
       "user_agent",
-      "token_scopes",
-      "programmatic_access_type"
+      "old_login",
+      "created_at",
+      "operation_type"
     ]
   },
   {
@@ -8479,18 +12952,30 @@
     "description": "A user reset their account password.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
-      "user",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
+      "user_agent",
       "created_at",
-      "@timestamp",
-      "_document_id",
-      "actor",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8498,16 +12983,29 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "created_at",
-      "request_id",
-      "user_id",
-      "action",
       "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
+      "user_id",
       "user_agent",
+      "created_at",
       "operation_type"
     ]
   },
@@ -8518,16 +13016,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "request_id",
-      "user_id",
       "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "operation_type",
+      "user_id",
       "user_agent",
-      "actor_id",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ],
     "docs_reference_titles": "Manage visibility settings for private contributions"
   },
@@ -8536,18 +13046,30 @@
     "description": "A user signed in from an unrecognized device.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "action",
+      "@timestamp",
       "_document_id",
-      "user_agent",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
+      "user_agent",
       "operation_type",
-      "created_at",
-      "actor",
-      "actor_id",
-      "@timestamp",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8555,18 +13077,30 @@
     "description": "A user signed in from an unrecognized device and location.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "@timestamp",
       "user_agent",
       "created_at",
-      "_document_id",
-      "request_id",
-      "action",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8574,22 +13108,33 @@
     "description": "Triggered when you clear the status on your profile.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
       "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "actor",
+      "user_agent",
       "message",
-      "user",
-      "actor_id",
       "created_at",
-      "request_id",
       "limited_availability",
-      "action",
       "emoji",
-      "operation_type",
-      "user_agent",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8597,23 +13142,33 @@
     "description": "Triggered when you set or change the status on your profile.",
     "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
     "fields": [
-      "limited_availability",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
       "actor_id",
-      "message",
-      "user_id",
-      "created_at",
-      "_document_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "@timestamp",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
+      "limited_availability",
+      "message",
+      "created_at",
       "emoji",
-      "org",
-      "actor",
-      "operation_type",
-      "token_scopes",
-      "programmatic_access_type"
+      "operation_type"
     ],
     "docs_reference_titles": "Personalize your profile"
   },
@@ -8622,21 +13177,31 @@
     "description": "A user account was suspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "oauth_application_id",
-      "operation_type",
-      "actor_id",
-      "user",
-      "user_agent",
-      "request_id",
-      "actor",
-      "created_at",
-      "_document_id",
       "@timestamp",
-      "user_id",
+      "_document_id",
       "action",
-      "token_scopes",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8644,37 +13209,61 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
-      "user",
-      "actor_id",
       "@timestamp",
-      "operation_type",
       "_document_id",
-      "user_agent",
-      "actor",
       "action",
-      "user_id",
-      "created_at",
-      "request_access_security_header"
-    ]
-  },
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
+    ]
+  },
   {
     "action": "user.two_factor_challenge_failure",
     "description": "A 2FA challenge issued for a user account failed.",
     "docs_reference_links": "N/A",
     "fields": [
-      "operation_type",
-      "created_at",
-      "_document_id",
-      "user_agent",
-      "user",
-      "actor_id",
-      "actor",
-      "user_id",
       "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "request_access_security_header"
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8684,16 +13273,28 @@
     "fields": [
       "@timestamp",
       "_document_id",
-      "user_id",
-      "operation_type",
+      "action",
+      "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
-      "actor",
+      "user_id",
       "user_agent",
-      "request_id",
-      "action",
-      "created_at",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8701,18 +13302,30 @@
     "description": "A user used their 2FA recovery codes.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user",
+      "@timestamp",
+      "_document_id",
       "action",
       "actor",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8720,18 +13333,30 @@
     "description": "A user downloaded 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_id",
-      "operation_type",
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
       "actor_id",
-      "user",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "action",
-      "@timestamp",
-      "created_at",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
       "user_agent",
-      "actor",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8739,17 +13364,30 @@
     "description": "A user printed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user",
-      "action",
-      "operation_type",
-      "user_agent",
-      "request_id",
-      "user_id",
-      "created_at",
+      "@timestamp",
       "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "@timestamp"
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8757,18 +13395,30 @@
     "description": "A user viewed 2FA recovery codes for their account.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
-      "user_agent",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "action",
+      "user_agent",
       "created_at",
-      "user",
-      "operation_type",
-      "@timestamp",
-      "request_id",
-      "_document_id",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8776,17 +13426,30 @@
     "description": "A user was prompted for a two-factor authentication code.",
     "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
     "fields": [
-      "user",
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
-      "user_agent",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "created_at",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
       "user_id",
-      "operation_type",
-      "@timestamp",
-      "actor"
+      "user_agent",
+      "created_at",
+      "operation_type"
     ],
     "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
   },
@@ -8795,19 +13458,31 @@
     "description": "A user was unblocked by another user.",
     "docs_reference_links": "N/A",
     "fields": [
-      "actor_id",
+      "@timestamp",
+      "_document_id",
       "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
-      "_document_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "blocked_user",
       "operation_type",
-      "actor",
-      "@timestamp",
-      "user_agent",
-      "user_id",
-      "user",
-      "created_at",
-      "request_access_security_header"
+      "created_at"
     ]
   },
   {
@@ -8815,21 +13490,31 @@
     "description": "A user account was unsuspended.",
     "docs_reference_links": "N/A",
     "fields": [
-      "request_id",
+      "@timestamp",
       "_document_id",
-      "user",
       "action",
-      "user_agent",
       "actor",
-      "oauth_application_id",
-      "operation_type",
       "actor_id",
-      "created_at",
-      "@timestamp",
-      "user_id",
-      "token_scopes",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
       "programmatic_access_type",
-      "request_access_security_header"
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "oauth_application_id",
+      "operation_type",
+      "created_at"
     ]
   },
   {
@@ -8837,21 +13522,33 @@
     "description": "A user secret for Codespaces was updated.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "key",
       "visibility",
       "integration",
-      "user",
-      "user_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8859,46 +13556,64 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "created_at",
+      "operation_type"
+    ]
+  },
+  {
+    "action": "workflows.approve_workflow_job",
+    "description": "A workflow job was approved.",
+    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
       "user",
       "user_id",
-      "action",
-      "operation_type",
-      "@timestamp",
-      "_document_id",
-      "request_access_security_header"
-    ]
-  },
-  {
-    "action": "workflows.approve_workflow_job",
-    "description": "A workflow job was approved.",
-    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
-    "fields": [
       "user_agent",
-      "request_id",
-      "actor",
-      "actor_id",
       "workflow_run_id",
       "run_number",
-      "user",
-      "user_id",
-      "repo",
-      "repo_id",
-      "business",
-      "business_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "token_scopes",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -8907,23 +13622,33 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
       "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_run_id",
       "run_number",
-      "repo",
-      "repo_id",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
-      "operation_type",
-      "request_access_security_header"
+      "operation_type"
     ]
   },
   {
@@ -8931,23 +13656,31 @@
     "description": "N/A",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
-      "token_id",
-      "hashed_token",
-      "programmatic_access_type",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "public_repo",
-      "org",
-      "org_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type"
     ]
@@ -8957,23 +13690,35 @@
     "description": "A workflow run was deleted.",
     "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "workflow_run_id",
       "started_at",
       "head_branch",
       "head_sha",
-      "trigger_id",
-      "programmatic_access_type"
+      "trigger_id"
     ],
     "docs_reference_titles": "Deleting a workflow run"
   },
@@ -8982,22 +13727,33 @@
     "description": "A workflow was disabled.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
       "public_repo",
-      "programmatic_access_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9005,21 +13761,32 @@
     "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
     "docs_reference_links": "N/A",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "workflow_id",
-      "action",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ]
   },
   {
@@ -9027,25 +13794,33 @@
     "description": "A workflow was pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   },
   {
@@ -9053,24 +13828,33 @@
     "description": "A workflow job was rejected.",
     "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
     "fields": [
-      "user_agent",
-      "request_id",
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "workflow_run_id",
-      "run_number",
-      "user",
-      "user_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
-      "action",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "workflow_run_id",
+      "run_number",
       "operation_type",
-      "@timestamp",
       "created_at",
-      "_document_id",
-      "public_repo",
-      "programmatic_access_type",
-      "request_access_security_header"
+      "public_repo"
     ],
     "docs_reference_titles": "Reviewing deployments"
   },
@@ -9079,25 +13863,33 @@
     "description": "A workflow was unpinned after previously being pinned.",
     "docs_reference_links": "N/A",
     "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
       "actor",
       "actor_id",
-      "user_agent",
-      "request_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
       "repo",
       "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
       "public_repo",
       "workflow_id",
-      "org",
-      "org_id",
-      "business",
-      "business_id",
-      "action",
-      "_document_id",
-      "@timestamp",
       "created_at",
       "operation_type",
-      "actor_is_bot",
-      "request_access_security_header"
+      "actor_is_bot"
     ]
   }
 ]
\ No newline at end of file
diff --git a/src/audit-logs/lib/index.ts b/src/audit-logs/lib/index.ts
index 8538890f844f..a9f47194ca9a 100644
--- a/src/audit-logs/lib/index.ts
+++ b/src/audit-logs/lib/index.ts
@@ -209,12 +209,14 @@ export async function filterByAllowlistValues({
   currentEvents = [],
   pipelineConfig,
   titleContext,
+  globalFields = [],
 }: {
   eventsToCheck: RawAuditLogEventT[]
   allowListValues: string | string[]
   currentEvents?: AuditLogEventT[]
   pipelineConfig: PipelineConfig
   titleContext?: TitleResolutionContext
+  globalFields?: string[]
 }) {
   if (!Array.isArray(allowListValues)) allowListValues = [allowListValues]
   if (!currentEvents) currentEvents = []
@@ -230,11 +232,18 @@ export async function filterByAllowlistValues({
       if (seen.has(event.action)) continue
       seen.add(event.action)
 
+      // Merge global fields with event-specific fields
+      const mergedFields = event.fields
+        ? [...new Set([...globalFields, ...event.fields])]
+        : globalFields.length > 0
+          ? [...globalFields]
+          : undefined
+
       const minimal: AuditLogEventT = {
         action: event.action,
         description: processAndGetEventDescription(event, eventAllowlists, pipelineConfig),
         docs_reference_links: event.docs_reference_links,
-        fields: event.fields,
+        fields: mergedFields,
       }
 
       // Resolve reference link titles if context is provided
@@ -290,6 +299,7 @@ export async function filterAndUpdateGhesDataByAllowlistValues({
   pipelineConfig,
   auditLogPage,
   titleContext,
+  globalFields = [],
 }: {
   eventsToCheck: RawAuditLogEventT[]
   allowListValue: string
@@ -297,6 +307,7 @@ export async function filterAndUpdateGhesDataByAllowlistValues({
   pipelineConfig: PipelineConfig
   auditLogPage: string
   titleContext?: TitleResolutionContext
+  globalFields?: string[]
 }) {
   if (!currentGhesEvents) currentGhesEvents = {}
 
@@ -316,11 +327,21 @@ export async function filterAndUpdateGhesDataByAllowlistValues({
       if (seenByGhesVersion.get(fullGhesVersion)?.has(event.action)) continue
 
       if (ghesVersionAllowlists.includes(allowListValue)) {
+        // Get event-specific fields (prefer GHES version fields, fall back to base fields)
+        const eventFields = event.ghes[ghesVersion].fields || event.fields
+
+        // Merge global fields with event-specific fields
+        const mergedFields = eventFields
+          ? [...new Set([...globalFields, ...eventFields])]
+          : globalFields.length > 0
+            ? [...globalFields]
+            : undefined
+
         const minimal: AuditLogEventT = {
           action: event.action,
           description: processAndGetEventDescription(event, ghesVersionAllowlists, pipelineConfig),
           docs_reference_links: event.docs_reference_links,
-          fields: event.ghes[ghesVersion].fields || event.fields,
+          fields: mergedFields,
         }
 
         // Resolve reference link titles if context is provided
diff --git a/src/audit-logs/scripts/sync.ts b/src/audit-logs/scripts/sync.ts
index a1ebc977230f..9be6dd6c2358 100755
--- a/src/audit-logs/scripts/sync.ts
+++ b/src/audit-logs/scripts/sync.ts
@@ -50,6 +50,22 @@ async function main() {
   const schemaEvents = JSON.parse(await getContents(owner, repo, ref, schemaFilePath))
   const mainSha = await getCommitSha(owner, repo, `heads/${ref}`)
 
+  // Fetch fields.json to get global fields that should be included in all events
+  const fieldsFilePath = 'allowlists/fields.json'
+  const fieldsData = JSON.parse(await getContents(owner, repo, ref, fieldsFilePath))
+
+  // Extract global fields (excluding those gated by feature flags)
+  if (!fieldsData.global?.include) {
+    console.warn('Warning: fieldsData.global.include not found, no global fields will be added')
+  }
+  type FieldsIncludeEntry = { fields: string[]; feature_flag?: string }
+  const globalFields: string[] =
+    fieldsData.global?.include
+      ?.filter((entry: FieldsIncludeEntry) => !entry.feature_flag)
+      ?.flatMap((entry: FieldsIncludeEntry) => entry.fields) || []
+
+  console.log(`Loaded ${globalFields.length} global fields from fields.json`)
+
   const configFilepath = `src/audit-logs/lib/config.json`
   const pipelineConfig = JSON.parse(await readFile(configFilepath, 'utf8'))
   pipelineConfig.sha = mainSha
@@ -90,6 +106,7 @@ async function main() {
       currentEvents,
       pipelineConfig,
       titleContext,
+      globalFields,
     })
   // Wrapper around filterGhesByAllowlistValues() because we always need all the
   // schema events and pipeline config data.
@@ -105,6 +122,7 @@ async function main() {
       pipelineConfig,
       auditLogPage,
       titleContext,
+      globalFields,
     })
 
   auditLogData.fpt = {}
diff --git a/src/audit-logs/tests/unit/filter-events.ts b/src/audit-logs/tests/unit/filter-events.ts
index 84064ac08091..8448289abd53 100644
--- a/src/audit-logs/tests/unit/filter-events.ts
+++ b/src/audit-logs/tests/unit/filter-events.ts
@@ -81,6 +81,99 @@ describe('audit log event filtering', () => {
     expect(filteredEvents.length).toBe(0)
   })
 
+  test('merges global fields with event-specific fields', async () => {
+    const eventsToProcess: RawAuditLogEventT[] = [
+      {
+        action: 'repo.create',
+        _allowlists: ['user'],
+        description: 'repo was created',
+        docs_reference_links: '',
+        ghes: {},
+        fields: ['repo', 'repo_id'],
+      },
+    ]
+
+    const filteredEvents = await filterByAllowlistValues({
+      eventsToCheck: eventsToProcess,
+      allowListValues: 'user',
+      currentEvents: [],
+      pipelineConfig: { sha: '', appendedDescriptions: {} },
+      globalFields: ['@timestamp', 'action'],
+    })
+    expect(filteredEvents[0].fields).toEqual(
+      expect.arrayContaining(['@timestamp', 'action', 'repo', 'repo_id']),
+    )
+    expect(filteredEvents[0].fields?.length).toBe(4)
+  })
+
+  test('deduplicates global fields already present in event fields', async () => {
+    const eventsToProcess: RawAuditLogEventT[] = [
+      {
+        action: 'repo.create',
+        _allowlists: ['user'],
+        description: 'repo was created',
+        docs_reference_links: '',
+        ghes: {},
+        fields: ['action', 'repo'],
+      },
+    ]
+
+    const filteredEvents = await filterByAllowlistValues({
+      eventsToCheck: eventsToProcess,
+      allowListValues: 'user',
+      currentEvents: [],
+      pipelineConfig: { sha: '', appendedDescriptions: {} },
+      globalFields: ['@timestamp', 'action'],
+    })
+    expect(filteredEvents[0].fields).toEqual(
+      expect.arrayContaining(['@timestamp', 'action', 'repo']),
+    )
+    expect(filteredEvents[0].fields?.length).toBe(3)
+  })
+
+  test('uses only global fields when event has no fields', async () => {
+    const eventsToProcess: RawAuditLogEventT[] = [
+      {
+        action: 'code_scanning.alert_created',
+        _allowlists: ['user'],
+        description: 'alert was created',
+        docs_reference_links: '',
+        ghes: {},
+      },
+    ]
+
+    const filteredEvents = await filterByAllowlistValues({
+      eventsToCheck: eventsToProcess,
+      allowListValues: 'user',
+      currentEvents: [],
+      pipelineConfig: { sha: '', appendedDescriptions: {} },
+      globalFields: ['@timestamp', 'action'],
+    })
+    expect(filteredEvents[0].fields).toEqual(['@timestamp', 'action'])
+  })
+
+  test('handles empty globalFields array', async () => {
+    const eventsToProcess: RawAuditLogEventT[] = [
+      {
+        action: 'repo.create',
+        _allowlists: ['user'],
+        description: 'repo was created',
+        docs_reference_links: '',
+        ghes: {},
+        fields: ['repo', 'repo_id'],
+      },
+    ]
+
+    const filteredEvents = await filterByAllowlistValues({
+      eventsToCheck: eventsToProcess,
+      allowListValues: 'user',
+      currentEvents: [],
+      pipelineConfig: { sha: '', appendedDescriptions: {} },
+      globalFields: [],
+    })
+    expect(filteredEvents[0].fields).toEqual(['repo', 'repo_id'])
+  })
+
   test('ghes filters and updates multiple ghes versions', async () => {
     const eventsToProcess: RawAuditLogEventT[] = [
       {